{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-29781",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-18T14:09:58.967344Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-18T14:10:03.696Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            references: [
               {
                  tags: [
                     "exploit",
                  ],
                  url: "https://github.com/metal3-io/metal3-docs/blob/main/design/baremetal-operator/bmc-events.md",
               },
            ],
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "baremetal-operator",
               vendor: "metal3-io",
               versions: [
                  {
                     status: "affected",
                     version: "= 0.9.0",
                  },
                  {
                     status: "affected",
                     version: "< 0.8.1",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. Baremetal Operator enables users to load Secret from arbitrary namespaces upon deployment of the namespace scoped Custom Resource `BMCEventSubscription`. Prior to versions 0.8.1 and 0.9.1, an adversary Kubernetes account with only namespace level roles (e.g. a tenant controlling a namespace) may create a `BMCEventSubscription` in his authorized namespace and then load Secrets from his unauthorized namespaces to his authorized namespace via the Baremetal Operator, causing Secret Leakage. The patch makes BMO refuse to read Secrets from other namespace than where the corresponding BMH resource is. The patch does not change the `BMCEventSubscription` API in BMO, but stricter validation will fail the request at admission time. It will also prevent the controller reading such Secrets, in case the BMCES CR has already been deployed. The issue exists for all versions of BMO, and is patched in BMO releases v0.9.1 and v0.8.1. Prior upgrading to patched BMO version, duplicate any existing Secret pointed to by `BMCEventSubscription`'s `httpHeadersRef` to the same namespace where the corresponding BMH exists. After upgrade, remove the old Secrets. As a workaround, the operator can configure BMO RBAC to be namespace scoped, instead of cluster scoped, to prevent BMO from accessing Secrets from other namespaces, and/or use `WATCH_NAMESPACE` configuration option to limit BMO to single namespace.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-653",
                     description: "CWE-653: Improper Isolation or Compartmentalization",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-17T21:37:31.856Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-c98h-7hp9-v9hq",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-c98h-7hp9-v9hq",
            },
            {
               name: "https://github.com/metal3-io/baremetal-operator/pull/2321",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/metal3-io/baremetal-operator/pull/2321",
            },
            {
               name: "https://github.com/metal3-io/baremetal-operator/pull/2322",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/metal3-io/baremetal-operator/pull/2322",
            },
            {
               name: "https://github.com/metal3-io/baremetal-operator/commit/19f8443b1fe182f76dd81b43122e8dd102f8b94c",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/metal3-io/baremetal-operator/commit/19f8443b1fe182f76dd81b43122e8dd102f8b94c",
            },
            {
               name: "https://github.com/metal3-io/metal3-docs/blob/main/design/baremetal-operator/bmc-events.md",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/metal3-io/metal3-docs/blob/main/design/baremetal-operator/bmc-events.md",
            },
         ],
         source: {
            advisory: "GHSA-c98h-7hp9-v9hq",
            discovery: "UNKNOWN",
         },
         title: "Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2025-29781",
      datePublished: "2025-03-17T21:37:31.856Z",
      dateReserved: "2025-03-11T14:23:00.475Z",
      dateUpdated: "2025-03-18T14:10:03.696Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-29786",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-17T13:29:22.591802Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-17T13:29:29.177Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "expr",
               vendor: "expr-lang",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.17.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree (AST) node for each part of the expression. In scenarios where input size isn’t limited, a malicious or inadvertent extremely large expression can consume excessive memory as the parser builds a huge AST. This can ultimately lead to*excessive memory usage and an Out-Of-Memory (OOM) crash of the process. This issue is relatively uncommon and will only manifest when there are no restrictions on the input size, i.e. the expression length is allowed to grow arbitrarily large. In typical use cases where inputs are bounded or validated, this problem would not occur. The problem has been patched in the latest versions of the Expr library. The fix introduces compile-time limits on the number of AST nodes and memory usage during parsing, preventing any single expression from exhausting resources. Users should upgrade to Expr version 1.17.0 or later, as this release includes the new node budget and memory limit safeguards. Upgrading to v1.17.0 ensures that extremely deep or large expressions are detected and safely aborted during compilation, avoiding the OOM condition. For users who cannot immediately upgrade, the recommended workaround is to impose an input size restriction before parsing. In practice, this means validating or limiting the length of expression strings that your application will accept. For example, set a maximum allowable number of characters (or nodes) for any expression and reject or truncate inputs that exceed this limit. By ensuring no unbounded-length expression is ever fed into the parser, one can prevent the parser from constructing a pathologically large AST and avoid potential memory exhaustion. In short, pre-validate and cap input size as a safeguard in the absence of the patch.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-770",
                     description: "CWE-770: Allocation of Resources Without Limits or Throttling",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-17T13:15:32.836Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/expr-lang/expr/security/advisories/GHSA-93mq-9ffx-83m2",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/expr-lang/expr/security/advisories/GHSA-93mq-9ffx-83m2",
            },
            {
               name: "https://github.com/expr-lang/expr/pull/762",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/expr-lang/expr/pull/762",
            },
         ],
         source: {
            advisory: "GHSA-93mq-9ffx-83m2",
            discovery: "UNKNOWN",
         },
         title: "Memory Exhaustion in Expr Parser with Unrestricted Input",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2025-29786",
      datePublished: "2025-03-17T13:15:32.836Z",
      dateReserved: "2025-03-11T14:23:00.476Z",
      dateUpdated: "2025-03-17T13:29:29.177Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-0495",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-18T16:25:23.455442Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-18T16:25:42.668Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               packageName: "buildx",
               product: "buildx",
               repo: "https://github.com/docker/buildx",
               vendor: "docker",
               versions: [
                  {
                     lessThanOrEqual: "0.21.2",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "<p>Buildx is a Docker CLI plugin that extends build capabilities using BuildKit.</p><p>Cache backends support credentials by setting secrets directly as attribute values in <code>cache-to/cache-from</code>&nbsp;configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command.&nbsp;OpenTelemetry traces are also saved in BuildKit daemon's history records.<br></p><p><span style=\"background-color: rgb(255, 255, 255);\">This vulnerability does not impact secrets passed to the Github cache backend&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">via environment variables or registry authentication</span>.</span><br></p><br>",
                  },
               ],
               value: "Buildx is a Docker CLI plugin that extends build capabilities using BuildKit.\n\nCache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command. OpenTelemetry traces are also saved in BuildKit daemon's history records.\n\n\nThis vulnerability does not impact secrets passed to the Github cache backend via environment variables or registry authentication.",
            },
         ],
         impacts: [
            {
               capecId: "CAPEC-21",
               descriptions: [
                  {
                     lang: "en",
                     value: "CAPEC-21 Exploitation of Trusted Identifiers",
                  },
               ],
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  Automatable: "NOT_DEFINED",
                  Recovery: "NOT_DEFINED",
                  Safety: "NOT_DEFINED",
                  attackComplexity: "LOW",
                  attackRequirements: "NONE",
                  attackVector: "LOCAL",
                  baseScore: 4.1,
                  baseSeverity: "MEDIUM",
                  privilegesRequired: "LOW",
                  providerUrgency: "NOT_DEFINED",
                  subAvailabilityImpact: "NONE",
                  subConfidentialityImpact: "HIGH",
                  subIntegrityImpact: "NONE",
                  userInteraction: "PASSIVE",
                  valueDensity: "NOT_DEFINED",
                  vectorString: "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
                  version: "4.0",
                  vulnAvailabilityImpact: "NONE",
                  vulnConfidentialityImpact: "LOW",
                  vulnIntegrityImpact: "NONE",
                  vulnerabilityResponseEffort: "NOT_DEFINED",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-532",
                     description: "CWE-532 Insertion of Sensitive Information into Log File",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-17T19:21:11.295Z",
            orgId: "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
            shortName: "Docker",
         },
         references: [
            {
               url: "https://github.com/docker/buildx",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         title: "Secrets leakage to telemetry endpoint via cache backend configuration via buildx",
         x_generator: {
            engine: "Vulnogram 0.2.0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
      assignerShortName: "Docker",
      cveId: "CVE-2025-0495",
      datePublished: "2025-03-17T19:21:11.295Z",
      dateReserved: "2025-01-15T15:26:40.672Z",
      dateUpdated: "2025-03-18T16:25:42.668Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-40635",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-18T14:17:05.162920Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-18T14:17:14.209Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "containerd",
               vendor: "containerd",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.6.38",
                  },
                  {
                     status: "affected",
                     version: ">= 1.7.0-beta.0, < 1.7.27",
                  },
                  {
                     status: "affected",
                     version: ">= 2.0.0-beta.0, < 2.0.4",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 4.6,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-190",
                     description: "CWE-190: Integer Overflow or Wraparound",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-17T21:32:37.894Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg",
            },
            {
               name: "https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da",
            },
            {
               name: "https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20",
            },
            {
               name: "https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a",
            },
         ],
         source: {
            advisory: "GHSA-265r-hfxg-fhmg",
            discovery: "UNKNOWN",
         },
         title: "containerd has an integer overflow in User ID handling",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2024-40635",
      datePublished: "2025-03-17T21:32:37.894Z",
      dateReserved: "2024-07-08T16:13:15.511Z",
      dateUpdated: "2025-03-18T14:17:14.209Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-2241",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-17T17:11:38.318059Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-17T17:11:48.110Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:multicluster_engine",
               ],
               defaultStatus: "affected",
               packageName: "multicluster-engine/multicloud-manager-rhel8",
               product: "Multicluster Engine for Kubernetes",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:acm:2",
               ],
               defaultStatus: "affected",
               packageName: "rhacm2/cluster-backup-rhel9-operator",
               product: "Red Hat Advanced Cluster Management for Kubernetes 2",
               vendor: "Red Hat",
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Red Hat would like to thank Eric Fried (REDHAT) for reporting this issue.",
            },
         ],
         datePublic: "2025-03-17T15:52:50.098Z",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Important",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 8.2,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-922",
                     description: "Insecure Storage of Sensitive Information",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-17T16:27:20.598Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2025-2241",
            },
            {
               name: "RHBZ#2351350",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2351350",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-03-11T12:43:34.302000+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2025-03-17T15:52:50.098000+00:00",
               value: "Made public.",
            },
         ],
         title: "Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm",
         workarounds: [
            {
               lang: "en",
               value: "A few mechanisms are available to reduce the risks and mitigate this vulnerability:\n\n1. Restrict Access to ClusterProvision Objects\n\nEnsure that only trusted users with valid VCenter credentials have read access to ClusterProvision objects.\nThis can be verified using the following commands:\n\noc adm policy who-can get clusterprovision\noc adm policy who-can read clusterprovision\n\n2. Rotate VCenter Credentials\n\nImmediately rotate VCenter credentials to revoke access for any users who may have already accessed the exposed credentials.\n\n3. Audit VCenter Users and Roles\n\nConduct a security audit of VCenter accounts and roles to detect any unauthorized access or configuration changes.\n\nIf any suspicious activity is found, revoke access by rotating credentials again (step 2) and taking necessary remediation actions.",
            },
         ],
         x_redhatCweChain: "CWE-922: Insecure Storage of Sensitive Information",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2025-2241",
      datePublished: "2025-03-17T16:27:20.598Z",
      dateReserved: "2025-03-12T04:52:38.166Z",
      dateUpdated: "2025-03-17T17:11:48.110Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}