RHBA-2023:6852
Vulnerability from csaf_redhat - Published: 2023-11-15 02:43 - Updated: 2026-08-11 20:49Summary
Red Hat Bug Fix Advisory: Red Hat Quay v3.9.5 minor release
Severity
Important
Notes
Topic: Red Hat Quay 3.9.5 is now available with bug fixes.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Quay 3.9.5
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as 'Important' as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit. CVE-2023-39325 was assigned for the `Rapid Reset Attack` in the Go language packages.
7.5 (High)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:64720f52471e388d2ad55e35380c7e00583b17a9601a031a87cbbe38923793ff_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:d264d660840f86395a11593e5860845be7d43caeba46ddbbf0ee959d19d797bd_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:553493a0bce8b643a8329cdc318f75bd50739704c03378ece54ce899787d118c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:c135d032cc5faef785fd6497a18ce507f1e0b25bb1264e7ea5149d7188f0abc5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:08519d06d04385ed9b2128a61baed37b2850e098e7c94d451c036b462d958637_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ebf9d98530220299f4c70e6af02bbd7b4993ecb2860ba90e8dbf442f3dedcf8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b57ba294963ecf71866c646c2dc01a4bac14e2fe7139cb3feee383f361c3fb37_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:3694b45af16019f667d19f8275d5edc9fcde4809131dd732a89e7f17e5012174_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:fbd2d54fe228283f0a8d7ae00982144d0751b89e143a58b2efde0db285496e7d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:3dd323614752b2ac850c6755dcdcdff15c9c660a8b4d7eeee7f5ee3b1eea8352_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in urllib3, a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, which is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.
5.9 (Medium)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:64720f52471e388d2ad55e35380c7e00583b17a9601a031a87cbbe38923793ff_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:d264d660840f86395a11593e5860845be7d43caeba46ddbbf0ee959d19d797bd_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:553493a0bce8b643a8329cdc318f75bd50739704c03378ece54ce899787d118c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:c135d032cc5faef785fd6497a18ce507f1e0b25bb1264e7ea5149d7188f0abc5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:08519d06d04385ed9b2128a61baed37b2850e098e7c94d451c036b462d958637_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ebf9d98530220299f4c70e6af02bbd7b4993ecb2860ba90e8dbf442f3dedcf8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b57ba294963ecf71866c646c2dc01a4bac14e2fe7139cb3feee383f361c3fb37_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:3694b45af16019f667d19f8275d5edc9fcde4809131dd732a89e7f17e5012174_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:fbd2d54fe228283f0a8d7ae00982144d0751b89e143a58b2efde0db285496e7d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:3dd323614752b2ac850c6755dcdcdff15c9c660a8b4d7eeee7f5ee3b1eea8352_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
15 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.9.5 is now available with bug fixes.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.9.5",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHBA-2023:6852",
"url": "https://access.redhat.com/errata/RHBA-2023:6852"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhba-2023_6852.json"
}
],
"title": "Red Hat Bug Fix Advisory: Red Hat Quay v3.9.5 minor release",
"tracking": {
"current_release_date": "2026-08-11T20:49:04+00:00",
"generator": {
"date": "2026-08-11T20:49:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.14"
}
},
"id": "RHBA-2023:6852",
"initial_release_date": "2023-11-15T02:43:46+00:00",
"revision_history": [
{
"date": "2023-11-15T02:43:46+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2023-11-15T02:43:46+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-11T20:49:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Quay v3",
"product": {
"name": "Quay v3",
"product_id": "8Base-Quay-3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "quay/quay-bridge-operator-bundle@sha256:d264d660840f86395a11593e5860845be7d43caeba46ddbbf0ee959d19d797bd_amd64",
"product": {
"name": "quay/quay-bridge-operator-bundle@sha256:d264d660840f86395a11593e5860845be7d43caeba46ddbbf0ee959d19d797bd_amd64",
"product_id": "quay/quay-bridge-operator-bundle@sha256:d264d660840f86395a11593e5860845be7d43caeba46ddbbf0ee959d19d797bd_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256:d264d660840f86395a11593e5860845be7d43caeba46ddbbf0ee959d19d797bd?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.9.5-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-bridge-operator-rhel8@sha256:553493a0bce8b643a8329cdc318f75bd50739704c03378ece54ce899787d118c_amd64",
"product": {
"name": "quay/quay-bridge-operator-rhel8@sha256:553493a0bce8b643a8329cdc318f75bd50739704c03378ece54ce899787d118c_amd64",
"product_id": "quay/quay-bridge-operator-rhel8@sha256:553493a0bce8b643a8329cdc318f75bd50739704c03378ece54ce899787d118c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:553493a0bce8b643a8329cdc318f75bd50739704c03378ece54ce899787d118c?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.9.5-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-rhel8@sha256:08519d06d04385ed9b2128a61baed37b2850e098e7c94d451c036b462d958637_amd64",
"product": {
"name": "quay/quay-builder-rhel8@sha256:08519d06d04385ed9b2128a61baed37b2850e098e7c94d451c036b462d958637_amd64",
"product_id": "quay/quay-builder-rhel8@sha256:08519d06d04385ed9b2128a61baed37b2850e098e7c94d451c036b462d958637_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256:08519d06d04385ed9b2128a61baed37b2850e098e7c94d451c036b462d958637?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.9.5-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:c135d032cc5faef785fd6497a18ce507f1e0b25bb1264e7ea5149d7188f0abc5_amd64",
"product": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:c135d032cc5faef785fd6497a18ce507f1e0b25bb1264e7ea5149d7188f0abc5_amd64",
"product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:c135d032cc5faef785fd6497a18ce507f1e0b25bb1264e7ea5149d7188f0abc5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:c135d032cc5faef785fd6497a18ce507f1e0b25bb1264e7ea5149d7188f0abc5?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.9.5-1"
}
}
},
{
"category": "product_version",
"name": "quay/clair-rhel8@sha256:64720f52471e388d2ad55e35380c7e00583b17a9601a031a87cbbe38923793ff_amd64",
"product": {
"name": "quay/clair-rhel8@sha256:64720f52471e388d2ad55e35380c7e00583b17a9601a031a87cbbe38923793ff_amd64",
"product_id": "quay/clair-rhel8@sha256:64720f52471e388d2ad55e35380c7e00583b17a9601a031a87cbbe38923793ff_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256:64720f52471e388d2ad55e35380c7e00583b17a9601a031a87cbbe38923793ff?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.9.5-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-bundle@sha256:9ebf9d98530220299f4c70e6af02bbd7b4993ecb2860ba90e8dbf442f3dedcf8_amd64",
"product": {
"name": "quay/quay-container-security-operator-bundle@sha256:9ebf9d98530220299f4c70e6af02bbd7b4993ecb2860ba90e8dbf442f3dedcf8_amd64",
"product_id": "quay/quay-container-security-operator-bundle@sha256:9ebf9d98530220299f4c70e6af02bbd7b4993ecb2860ba90e8dbf442f3dedcf8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256:9ebf9d98530220299f4c70e6af02bbd7b4993ecb2860ba90e8dbf442f3dedcf8?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.9.5-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-rhel8@sha256:b57ba294963ecf71866c646c2dc01a4bac14e2fe7139cb3feee383f361c3fb37_amd64",
"product": {
"name": "quay/quay-container-security-operator-rhel8@sha256:b57ba294963ecf71866c646c2dc01a4bac14e2fe7139cb3feee383f361c3fb37_amd64",
"product_id": "quay/quay-container-security-operator-rhel8@sha256:b57ba294963ecf71866c646c2dc01a4bac14e2fe7139cb3feee383f361c3fb37_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:b57ba294963ecf71866c646c2dc01a4bac14e2fe7139cb3feee383f361c3fb37?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.9.5-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-bundle@sha256:3694b45af16019f667d19f8275d5edc9fcde4809131dd732a89e7f17e5012174_amd64",
"product": {
"name": "quay/quay-operator-bundle@sha256:3694b45af16019f667d19f8275d5edc9fcde4809131dd732a89e7f17e5012174_amd64",
"product_id": "quay/quay-operator-bundle@sha256:3694b45af16019f667d19f8275d5edc9fcde4809131dd732a89e7f17e5012174_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256:3694b45af16019f667d19f8275d5edc9fcde4809131dd732a89e7f17e5012174?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.9.5-5"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-rhel8@sha256:fbd2d54fe228283f0a8d7ae00982144d0751b89e143a58b2efde0db285496e7d_amd64",
"product": {
"name": "quay/quay-operator-rhel8@sha256:fbd2d54fe228283f0a8d7ae00982144d0751b89e143a58b2efde0db285496e7d_amd64",
"product_id": "quay/quay-operator-rhel8@sha256:fbd2d54fe228283f0a8d7ae00982144d0751b89e143a58b2efde0db285496e7d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256:fbd2d54fe228283f0a8d7ae00982144d0751b89e143a58b2efde0db285496e7d?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.9.5-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-rhel8@sha256:3dd323614752b2ac850c6755dcdcdff15c9c660a8b4d7eeee7f5ee3b1eea8352_amd64",
"product": {
"name": "quay/quay-rhel8@sha256:3dd323614752b2ac850c6755dcdcdff15c9c660a8b4d7eeee7f5ee3b1eea8352_amd64",
"product_id": "quay/quay-rhel8@sha256:3dd323614752b2ac850c6755dcdcdff15c9c660a8b4d7eeee7f5ee3b1eea8352_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256:3dd323614752b2ac850c6755dcdcdff15c9c660a8b4d7eeee7f5ee3b1eea8352?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.9.5-4"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/clair-rhel8@sha256:64720f52471e388d2ad55e35380c7e00583b17a9601a031a87cbbe38923793ff_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:64720f52471e388d2ad55e35380c7e00583b17a9601a031a87cbbe38923793ff_amd64"
},
"product_reference": "quay/clair-rhel8@sha256:64720f52471e388d2ad55e35380c7e00583b17a9601a031a87cbbe38923793ff_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-bundle@sha256:d264d660840f86395a11593e5860845be7d43caeba46ddbbf0ee959d19d797bd_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:d264d660840f86395a11593e5860845be7d43caeba46ddbbf0ee959d19d797bd_amd64"
},
"product_reference": "quay/quay-bridge-operator-bundle@sha256:d264d660840f86395a11593e5860845be7d43caeba46ddbbf0ee959d19d797bd_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-rhel8@sha256:553493a0bce8b643a8329cdc318f75bd50739704c03378ece54ce899787d118c_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:553493a0bce8b643a8329cdc318f75bd50739704c03378ece54ce899787d118c_amd64"
},
"product_reference": "quay/quay-bridge-operator-rhel8@sha256:553493a0bce8b643a8329cdc318f75bd50739704c03378ece54ce899787d118c_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:c135d032cc5faef785fd6497a18ce507f1e0b25bb1264e7ea5149d7188f0abc5_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:c135d032cc5faef785fd6497a18ce507f1e0b25bb1264e7ea5149d7188f0abc5_amd64"
},
"product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:c135d032cc5faef785fd6497a18ce507f1e0b25bb1264e7ea5149d7188f0abc5_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-rhel8@sha256:08519d06d04385ed9b2128a61baed37b2850e098e7c94d451c036b462d958637_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:08519d06d04385ed9b2128a61baed37b2850e098e7c94d451c036b462d958637_amd64"
},
"product_reference": "quay/quay-builder-rhel8@sha256:08519d06d04385ed9b2128a61baed37b2850e098e7c94d451c036b462d958637_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-bundle@sha256:9ebf9d98530220299f4c70e6af02bbd7b4993ecb2860ba90e8dbf442f3dedcf8_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ebf9d98530220299f4c70e6af02bbd7b4993ecb2860ba90e8dbf442f3dedcf8_amd64"
},
"product_reference": "quay/quay-container-security-operator-bundle@sha256:9ebf9d98530220299f4c70e6af02bbd7b4993ecb2860ba90e8dbf442f3dedcf8_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-rhel8@sha256:b57ba294963ecf71866c646c2dc01a4bac14e2fe7139cb3feee383f361c3fb37_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b57ba294963ecf71866c646c2dc01a4bac14e2fe7139cb3feee383f361c3fb37_amd64"
},
"product_reference": "quay/quay-container-security-operator-rhel8@sha256:b57ba294963ecf71866c646c2dc01a4bac14e2fe7139cb3feee383f361c3fb37_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-bundle@sha256:3694b45af16019f667d19f8275d5edc9fcde4809131dd732a89e7f17e5012174_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:3694b45af16019f667d19f8275d5edc9fcde4809131dd732a89e7f17e5012174_amd64"
},
"product_reference": "quay/quay-operator-bundle@sha256:3694b45af16019f667d19f8275d5edc9fcde4809131dd732a89e7f17e5012174_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-rhel8@sha256:fbd2d54fe228283f0a8d7ae00982144d0751b89e143a58b2efde0db285496e7d_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:fbd2d54fe228283f0a8d7ae00982144d0751b89e143a58b2efde0db285496e7d_amd64"
},
"product_reference": "quay/quay-operator-rhel8@sha256:fbd2d54fe228283f0a8d7ae00982144d0751b89e143a58b2efde0db285496e7d_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-rhel8@sha256:3dd323614752b2ac850c6755dcdcdff15c9c660a8b4d7eeee7f5ee3b1eea8352_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:3dd323614752b2ac850c6755dcdcdff15c9c660a8b4d7eeee7f5ee3b1eea8352_amd64"
},
"product_reference": "quay/quay-rhel8@sha256:3dd323614752b2ac850c6755dcdcdff15c9c660a8b4d7eeee7f5ee3b1eea8352_amd64",
"relates_to_product_reference": "8Base-Quay-3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-39325",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2023-10-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2243296"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as \u0027Important\u0027 as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit.\r\n\r\nCVE-2023-39325 was assigned for the `Rapid Reset Attack` in the Go language packages.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This CVE is related to CVE-2023-44487.\n\nThe majority of RHEL utilities are not long-running applications; instead, they are command-line tools. These tools utilize Golang package as build-time dependency, which is why they are classified as having a \"Moderate\" level of impact.\n\nAs go-lang vendors its dependencies, a package may contain a library with a known vulnerability, solely because of lower tier libraries including it as a part of its dependencies, but the vulnerable code is not reachable at runtime. In such cases the issue is not exploitable. We classify these situations as \u201cNot affected\u201d or \u201cWill not fix,\u201d depending on the risk of breaking other unrelated packages.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:64720f52471e388d2ad55e35380c7e00583b17a9601a031a87cbbe38923793ff_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:d264d660840f86395a11593e5860845be7d43caeba46ddbbf0ee959d19d797bd_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:553493a0bce8b643a8329cdc318f75bd50739704c03378ece54ce899787d118c_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:c135d032cc5faef785fd6497a18ce507f1e0b25bb1264e7ea5149d7188f0abc5_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:08519d06d04385ed9b2128a61baed37b2850e098e7c94d451c036b462d958637_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ebf9d98530220299f4c70e6af02bbd7b4993ecb2860ba90e8dbf442f3dedcf8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b57ba294963ecf71866c646c2dc01a4bac14e2fe7139cb3feee383f361c3fb37_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3694b45af16019f667d19f8275d5edc9fcde4809131dd732a89e7f17e5012174_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:fbd2d54fe228283f0a8d7ae00982144d0751b89e143a58b2efde0db285496e7d_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:3dd323614752b2ac850c6755dcdcdff15c9c660a8b4d7eeee7f5ee3b1eea8352_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-39325"
},
{
"category": "external",
"summary": "RHBZ#2243296",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243296"
},
{
"category": "external",
"summary": "RHSB-2023-003",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-39325",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39325"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-39325",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39325"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2023-44487",
"url": "https://access.redhat.com/security/cve/CVE-2023-44487"
},
{
"category": "external",
"summary": "https://go.dev/issue/63417",
"url": "https://go.dev/issue/63417"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2023-2102",
"url": "https://pkg.go.dev/vuln/GO-2023-2102"
},
{
"category": "external",
"summary": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487",
"url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487"
}
],
"release_date": "2023-10-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-11-15T02:43:46+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:64720f52471e388d2ad55e35380c7e00583b17a9601a031a87cbbe38923793ff_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:d264d660840f86395a11593e5860845be7d43caeba46ddbbf0ee959d19d797bd_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:553493a0bce8b643a8329cdc318f75bd50739704c03378ece54ce899787d118c_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:c135d032cc5faef785fd6497a18ce507f1e0b25bb1264e7ea5149d7188f0abc5_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:08519d06d04385ed9b2128a61baed37b2850e098e7c94d451c036b462d958637_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ebf9d98530220299f4c70e6af02bbd7b4993ecb2860ba90e8dbf442f3dedcf8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b57ba294963ecf71866c646c2dc01a4bac14e2fe7139cb3feee383f361c3fb37_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3694b45af16019f667d19f8275d5edc9fcde4809131dd732a89e7f17e5012174_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:fbd2d54fe228283f0a8d7ae00982144d0751b89e143a58b2efde0db285496e7d_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:3dd323614752b2ac850c6755dcdcdff15c9c660a8b4d7eeee7f5ee3b1eea8352_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2023:6852"
},
{
"category": "workaround",
"details": "The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:64720f52471e388d2ad55e35380c7e00583b17a9601a031a87cbbe38923793ff_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:d264d660840f86395a11593e5860845be7d43caeba46ddbbf0ee959d19d797bd_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:553493a0bce8b643a8329cdc318f75bd50739704c03378ece54ce899787d118c_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:c135d032cc5faef785fd6497a18ce507f1e0b25bb1264e7ea5149d7188f0abc5_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:08519d06d04385ed9b2128a61baed37b2850e098e7c94d451c036b462d958637_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ebf9d98530220299f4c70e6af02bbd7b4993ecb2860ba90e8dbf442f3dedcf8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b57ba294963ecf71866c646c2dc01a4bac14e2fe7139cb3feee383f361c3fb37_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3694b45af16019f667d19f8275d5edc9fcde4809131dd732a89e7f17e5012174_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:fbd2d54fe228283f0a8d7ae00982144d0751b89e143a58b2efde0db285496e7d_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:3dd323614752b2ac850c6755dcdcdff15c9c660a8b4d7eeee7f5ee3b1eea8352_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:64720f52471e388d2ad55e35380c7e00583b17a9601a031a87cbbe38923793ff_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:d264d660840f86395a11593e5860845be7d43caeba46ddbbf0ee959d19d797bd_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:553493a0bce8b643a8329cdc318f75bd50739704c03378ece54ce899787d118c_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:c135d032cc5faef785fd6497a18ce507f1e0b25bb1264e7ea5149d7188f0abc5_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:08519d06d04385ed9b2128a61baed37b2850e098e7c94d451c036b462d958637_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ebf9d98530220299f4c70e6af02bbd7b4993ecb2860ba90e8dbf442f3dedcf8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b57ba294963ecf71866c646c2dc01a4bac14e2fe7139cb3feee383f361c3fb37_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3694b45af16019f667d19f8275d5edc9fcde4809131dd732a89e7f17e5012174_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:fbd2d54fe228283f0a8d7ae00982144d0751b89e143a58b2efde0db285496e7d_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:3dd323614752b2ac850c6755dcdcdff15c9c660a8b4d7eeee7f5ee3b1eea8352_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)"
},
{
"cve": "CVE-2023-43804",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2023-10-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2242493"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, a user-friendly HTTP client library for Python. urllib3 doesn\u0027t treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, which is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn\u0027t disable redirects explicitly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-urllib3: Cookie request header isn\u0027t stripped during cross-origin redirects",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:64720f52471e388d2ad55e35380c7e00583b17a9601a031a87cbbe38923793ff_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:d264d660840f86395a11593e5860845be7d43caeba46ddbbf0ee959d19d797bd_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:553493a0bce8b643a8329cdc318f75bd50739704c03378ece54ce899787d118c_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:c135d032cc5faef785fd6497a18ce507f1e0b25bb1264e7ea5149d7188f0abc5_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:08519d06d04385ed9b2128a61baed37b2850e098e7c94d451c036b462d958637_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ebf9d98530220299f4c70e6af02bbd7b4993ecb2860ba90e8dbf442f3dedcf8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b57ba294963ecf71866c646c2dc01a4bac14e2fe7139cb3feee383f361c3fb37_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3694b45af16019f667d19f8275d5edc9fcde4809131dd732a89e7f17e5012174_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:fbd2d54fe228283f0a8d7ae00982144d0751b89e143a58b2efde0db285496e7d_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:3dd323614752b2ac850c6755dcdcdff15c9c660a8b4d7eeee7f5ee3b1eea8352_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-43804"
},
{
"category": "external",
"summary": "RHBZ#2242493",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242493"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-43804",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43804"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804"
}
],
"release_date": "2023-10-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-11-15T02:43:46+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:64720f52471e388d2ad55e35380c7e00583b17a9601a031a87cbbe38923793ff_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:d264d660840f86395a11593e5860845be7d43caeba46ddbbf0ee959d19d797bd_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:553493a0bce8b643a8329cdc318f75bd50739704c03378ece54ce899787d118c_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:c135d032cc5faef785fd6497a18ce507f1e0b25bb1264e7ea5149d7188f0abc5_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:08519d06d04385ed9b2128a61baed37b2850e098e7c94d451c036b462d958637_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ebf9d98530220299f4c70e6af02bbd7b4993ecb2860ba90e8dbf442f3dedcf8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b57ba294963ecf71866c646c2dc01a4bac14e2fe7139cb3feee383f361c3fb37_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3694b45af16019f667d19f8275d5edc9fcde4809131dd732a89e7f17e5012174_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:fbd2d54fe228283f0a8d7ae00982144d0751b89e143a58b2efde0db285496e7d_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:3dd323614752b2ac850c6755dcdcdff15c9c660a8b4d7eeee7f5ee3b1eea8352_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2023:6852"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:64720f52471e388d2ad55e35380c7e00583b17a9601a031a87cbbe38923793ff_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:d264d660840f86395a11593e5860845be7d43caeba46ddbbf0ee959d19d797bd_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:553493a0bce8b643a8329cdc318f75bd50739704c03378ece54ce899787d118c_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:c135d032cc5faef785fd6497a18ce507f1e0b25bb1264e7ea5149d7188f0abc5_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:08519d06d04385ed9b2128a61baed37b2850e098e7c94d451c036b462d958637_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ebf9d98530220299f4c70e6af02bbd7b4993ecb2860ba90e8dbf442f3dedcf8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b57ba294963ecf71866c646c2dc01a4bac14e2fe7139cb3feee383f361c3fb37_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3694b45af16019f667d19f8275d5edc9fcde4809131dd732a89e7f17e5012174_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:fbd2d54fe228283f0a8d7ae00982144d0751b89e143a58b2efde0db285496e7d_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:3dd323614752b2ac850c6755dcdcdff15c9c660a8b4d7eeee7f5ee3b1eea8352_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:64720f52471e388d2ad55e35380c7e00583b17a9601a031a87cbbe38923793ff_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:d264d660840f86395a11593e5860845be7d43caeba46ddbbf0ee959d19d797bd_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:553493a0bce8b643a8329cdc318f75bd50739704c03378ece54ce899787d118c_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:c135d032cc5faef785fd6497a18ce507f1e0b25bb1264e7ea5149d7188f0abc5_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:08519d06d04385ed9b2128a61baed37b2850e098e7c94d451c036b462d958637_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ebf9d98530220299f4c70e6af02bbd7b4993ecb2860ba90e8dbf442f3dedcf8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b57ba294963ecf71866c646c2dc01a4bac14e2fe7139cb3feee383f361c3fb37_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3694b45af16019f667d19f8275d5edc9fcde4809131dd732a89e7f17e5012174_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:fbd2d54fe228283f0a8d7ae00982144d0751b89e143a58b2efde0db285496e7d_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:3dd323614752b2ac850c6755dcdcdff15c9c660a8b4d7eeee7f5ee3b1eea8352_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-urllib3: Cookie request header isn\u0027t stripped during cross-origin redirects"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…