Vulnerability-Lookup

RHBA-2025:1077

Vulnerability from csaf_redhat - Published: 2025-02-06 09:14 - Updated: 2026-08-09 04:08

Summary

Red Hat Bug Fix Advisory: Red Hat Quay v3.10.8 bug fix release

Severity

Important

Notes

Topic: Red Hat Quay 3.10.8 is now available with bug fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Quay 3.10.8

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2024-45337

A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

CWE-285 - Improper Authorization

Affected products

Fixed 30 products

Product	Version	Remediation
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2024-56201

A flaw was found in the Jinja2 package. A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of Jinja's sandbox being used. An attacker needs to be able to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates where the template author can also choose the template filename.

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Affected products

Fixed 30 products

Product	Version	Remediation
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2024-56326

A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, storing a reference to a malicious string's format method is possible, then passing that to a filter that calls it. No such filters are built into Jinja but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Affected products

Fixed 30 products

Product	Version	Remediation
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le	—	Vendor Fix fix

Threats

Impact Moderate

References

25 references

URL	Category
https://access.redhat.com/errata/RHBA-2025:1077	self
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2024-45337	self
https://bugzilla.redhat.com/show_bug.cgi?id=2331720	external
https://www.cve.org/CVERecord?id=CVE-2024-45337	external
https://nvd.nist.gov/vuln/detail/CVE-2024-45337	external
https://github.com/golang/crypto/commit/b4f1988a3…	external
https://go.dev/cl/635315	external
https://go.dev/issue/70779	external
https://groups.google.com/g/golang-announce/c/-nP…	external
https://pkg.go.dev/vuln/GO-2024-3321	external
https://access.redhat.com/security/cve/CVE-2024-56201	self
https://bugzilla.redhat.com/show_bug.cgi?id=2333854	external
https://www.cve.org/CVERecord?id=CVE-2024-56201	external
https://nvd.nist.gov/vuln/detail/CVE-2024-56201	external
https://github.com/pallets/jinja/commit/767b23617…	external
https://github.com/pallets/jinja/issues/1792	external
https://github.com/pallets/jinja/releases/tag/3.1.5	external
https://github.com/pallets/jinja/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2024-56326	self
https://bugzilla.redhat.com/show_bug.cgi?id=2333856	external
https://www.cve.org/CVERecord?id=CVE-2024-56326	external
https://nvd.nist.gov/vuln/detail/CVE-2024-56326	external
https://github.com/pallets/jinja/commit/48b0687e0…	external
https://github.com/pallets/jinja/security/advisor…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Quay 3.10.8 is now available with bug fixes.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Quay 3.10.8",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2025:1077",
        "url": "https://access.redhat.com/errata/RHBA-2025:1077"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_1077.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: Red Hat Quay v3.10.8 bug fix release",
    "tracking": {
      "current_release_date": "2026-08-09T04:08:34+00:00",
      "generator": {
        "date": "2026-08-09T04:08:34+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.12"
        }
      },
      "id": "RHBA-2025:1077",
      "initial_release_date": "2025-02-06T09:14:40+00:00",
      "revision_history": [
        {
          "date": "2025-02-06T09:14:40+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-02-06T09:14:40+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-09T04:08:34+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Quay v3",
                "product": {
                  "name": "Quay v3",
                  "product_id": "8Base-Quay-3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quay:3::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Quay"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x",
                "product": {
                  "name": "quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x",
                  "product_id": "quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.10.8-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x",
                "product": {
                  "name": "quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x",
                  "product_id": "quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.10.8-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x",
                "product": {
                  "name": "quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x",
                  "product_id": "quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.10.8-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x",
                "product": {
                  "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x",
                  "product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.10.8-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x",
                "product": {
                  "name": "quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x",
                  "product_id": "quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.10.8-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x",
                "product": {
                  "name": "quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x",
                  "product_id": "quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.10.8-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x",
                "product": {
                  "name": "quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x",
                  "product_id": "quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.10.8-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x",
                "product": {
                  "name": "quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x",
                  "product_id": "quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.10.8-12"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x",
                "product": {
                  "name": "quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x",
                  "product_id": "quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.10.8-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x",
                "product": {
                  "name": "quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x",
                  "product_id": "quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.10.8-6"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le",
                "product": {
                  "name": "quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le",
                  "product_id": "quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.10.8-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le",
                "product": {
                  "name": "quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le",
                  "product_id": "quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.10.8-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le",
                "product": {
                  "name": "quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le",
                  "product_id": "quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.10.8-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le",
                "product": {
                  "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le",
                  "product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.10.8-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le",
                "product": {
                  "name": "quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le",
                  "product_id": "quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.10.8-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le",
                "product": {
                  "name": "quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le",
                  "product_id": "quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.10.8-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le",
                "product": {
                  "name": "quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le",
                  "product_id": "quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.10.8-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le",
                "product": {
                  "name": "quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le",
                  "product_id": "quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.10.8-12"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le",
                "product": {
                  "name": "quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le",
                  "product_id": "quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.10.8-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le",
                "product": {
                  "name": "quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le",
                  "product_id": "quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.10.8-6"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64",
                "product": {
                  "name": "quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64",
                  "product_id": "quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.10.8-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64",
                "product": {
                  "name": "quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64",
                  "product_id": "quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.10.8-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64",
                "product": {
                  "name": "quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64",
                  "product_id": "quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.10.8-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64",
                "product": {
                  "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64",
                  "product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.10.8-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64",
                "product": {
                  "name": "quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64",
                  "product_id": "quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.10.8-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64",
                "product": {
                  "name": "quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64",
                  "product_id": "quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.10.8-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64",
                "product": {
                  "name": "quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64",
                  "product_id": "quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.10.8-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64",
                "product": {
                  "name": "quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64",
                  "product_id": "quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.10.8-12"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64",
                "product": {
                  "name": "quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64",
                  "product_id": "quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.10.8-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64",
                "product": {
                  "name": "quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64",
                  "product_id": "quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.10.8-6"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x"
        },
        "product_reference": "quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le"
        },
        "product_reference": "quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64"
        },
        "product_reference": "quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le"
        },
        "product_reference": "quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x"
        },
        "product_reference": "quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64"
        },
        "product_reference": "quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x"
        },
        "product_reference": "quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le"
        },
        "product_reference": "quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64"
        },
        "product_reference": "quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x"
        },
        "product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le"
        },
        "product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64"
        },
        "product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le"
        },
        "product_reference": "quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64"
        },
        "product_reference": "quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x"
        },
        "product_reference": "quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64"
        },
        "product_reference": "quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x"
        },
        "product_reference": "quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le"
        },
        "product_reference": "quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x"
        },
        "product_reference": "quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le"
        },
        "product_reference": "quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64"
        },
        "product_reference": "quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x"
        },
        "product_reference": "quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64"
        },
        "product_reference": "quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le"
        },
        "product_reference": "quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x"
        },
        "product_reference": "quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64"
        },
        "product_reference": "quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le"
        },
        "product_reference": "quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64"
        },
        "product_reference": "quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x"
        },
        "product_reference": "quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le"
        },
        "product_reference": "quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-45337",
      "cwe": {
        "id": "CWE-285",
        "name": "Improper Authorization"
      },
      "discovery_date": "2024-12-11T19:00:54.247490+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331720"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is classified as important rather than critical because it does not directly enable unauthorized access but rather introduces a risk of authorization bypass if the application or library misuses the PublicKeyCallback API. The vulnerability relies on incorrect assumptions made by the application when handling the sequence or state of keys provided during SSH authentication. Properly implemented systems that use the Permissions field or avoid relying on external state remain unaffected. Additionally, the vulnerability does not allow direct exploitation to gain control over a system without the presence of insecure logic in the application\u0027s handling of authentication attempts.\n\n\nRed Hat Enterprise Linux(RHEL) 8 \u0026 9 and Red Hat Openshift marked as not affected as it was determined that the problem function `ServerConfig.PublicKeyCallback`, as noted in the CVE-2024-45337 issue, is not called by Podman, Buildah, containers-common, or the gvisor-tap-vsock projects.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-Quay-3:quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x",
          "8Base-Quay-3:quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le",
          "8Base-Quay-3:quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le",
          "8Base-Quay-3:quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64",
          "8Base-Quay-3:quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x",
          "8Base-Quay-3:quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-45337"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331720",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331720"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-45337",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-45337"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45337",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45337"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909",
          "url": "https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/635315",
          "url": "https://go.dev/cl/635315"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/70779",
          "url": "https://go.dev/issue/70779"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ",
          "url": "https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-3321",
          "url": "https://pkg.go.dev/vuln/GO-2024-3321"
        }
      ],
      "release_date": "2024-12-11T18:55:58.506000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-02-06T09:14:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x",
            "8Base-Quay-3:quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le",
            "8Base-Quay-3:quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le",
            "8Base-Quay-3:quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x",
            "8Base-Quay-3:quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2025:1077"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x",
            "8Base-Quay-3:quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le",
            "8Base-Quay-3:quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le",
            "8Base-Quay-3:quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x",
            "8Base-Quay-3:quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x",
            "8Base-Quay-3:quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le",
            "8Base-Quay-3:quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le",
            "8Base-Quay-3:quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x",
            "8Base-Quay-3:quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto"
    },
    {
      "cve": "CVE-2024-56201",
      "cwe": {
        "id": "CWE-150",
        "name": "Improper Neutralization of Escape, Meta, or Control Sequences"
      },
      "discovery_date": "2024-12-23T16:00:38.768252+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2333854"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Jinja2 package. A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of Jinja\u0027s sandbox being used. An attacker needs to be able to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates where the template author can also choose the template filename.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jinja2: Jinja has a sandbox breakout through malicious filenames",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability has rated as a IMPORTANT flaw because an attacker controlling both the template content and filename to execute arbitrary Python code, bypassing the sandbox.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-Quay-3:quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x",
          "8Base-Quay-3:quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le",
          "8Base-Quay-3:quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le",
          "8Base-Quay-3:quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64",
          "8Base-Quay-3:quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x",
          "8Base-Quay-3:quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-56201"
        },
        {
          "category": "external",
          "summary": "RHBZ#2333854",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333854"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-56201",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-56201"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-56201",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56201"
        },
        {
          "category": "external",
          "summary": "https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f",
          "url": "https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f"
        },
        {
          "category": "external",
          "summary": "https://github.com/pallets/jinja/issues/1792",
          "url": "https://github.com/pallets/jinja/issues/1792"
        },
        {
          "category": "external",
          "summary": "https://github.com/pallets/jinja/releases/tag/3.1.5",
          "url": "https://github.com/pallets/jinja/releases/tag/3.1.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699",
          "url": "https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699"
        }
      ],
      "release_date": "2024-12-23T15:37:36.110000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-02-06T09:14:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x",
            "8Base-Quay-3:quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le",
            "8Base-Quay-3:quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le",
            "8Base-Quay-3:quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x",
            "8Base-Quay-3:quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2025:1077"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerabilty restrict user-controlled template filenames, ensuring they follow a predefined templates.",
          "product_ids": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x",
            "8Base-Quay-3:quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le",
            "8Base-Quay-3:quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le",
            "8Base-Quay-3:quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x",
            "8Base-Quay-3:quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x",
            "8Base-Quay-3:quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le",
            "8Base-Quay-3:quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le",
            "8Base-Quay-3:quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x",
            "8Base-Quay-3:quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jinja2: Jinja has a sandbox breakout through malicious filenames"
    },
    {
      "cve": "CVE-2024-56326",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2024-12-23T16:00:46.619763+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2333856"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates. Jinja\u0027s sandbox does catch calls to str.format and ensures they don\u0027t escape the sandbox. However, storing a reference to a malicious string\u0027s format method is possible, then passing that to a filter that calls it. No such filters are built into Jinja but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jinja2: Jinja has a sandbox breakout through indirect reference to format method",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate due to an oversight in Jinja\u0027s sandbox environment, allowing attackers to execute arbitrary Python code through controlled template content. This requires control over template content, making exploitation possible only in specific applications, thus limiting its overall impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-Quay-3:quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x",
          "8Base-Quay-3:quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le",
          "8Base-Quay-3:quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le",
          "8Base-Quay-3:quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64",
          "8Base-Quay-3:quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x",
          "8Base-Quay-3:quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-56326"
        },
        {
          "category": "external",
          "summary": "RHBZ#2333856",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333856"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-56326",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-56326"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-56326",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56326"
        },
        {
          "category": "external",
          "summary": "https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4",
          "url": "https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4"
        },
        {
          "category": "external",
          "summary": "https://github.com/pallets/jinja/releases/tag/3.1.5",
          "url": "https://github.com/pallets/jinja/releases/tag/3.1.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h",
          "url": "https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h"
        }
      ],
      "release_date": "2024-12-23T15:43:49.400000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-02-06T09:14:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x",
            "8Base-Quay-3:quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le",
            "8Base-Quay-3:quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le",
            "8Base-Quay-3:quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x",
            "8Base-Quay-3:quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2025:1077"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:17b352e88ffa8864ac847ae0a76cddc92e87384863c9fde2471462099fcce86a_s390x",
            "8Base-Quay-3:quay/clair-rhel8@sha256:42f3eeed152b34c28380de2da842c408f2f57726bb0da5add5fc8e9b5f9ae436_ppc64le",
            "8Base-Quay-3:quay/clair-rhel8@sha256:9deabbf1ccb7d69e2b419e15afe47d797f99851b1a245f4a0884727201209825_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:15bbf14bed08a24b8f23a104f6444100105bea1fd6b232e1f8981c82838849d9_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:5e2f7e76a088e7a9d7abc2169c4bca169032f2704921fcda7494f3fe1729e4dd_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:ed14135f126057c2f55c685426aa03dcde3633b9ab911f6c49ad57fb85cf2946_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:a9bd7232653e7254f7fbbcadbfae0b929a868fa02ab083314d575a783901b3e3_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ae2661b73d422924ba37ed1100b4c1bfc013441d5abfcf53108ef4b2942ca5ff_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f3850ff713a9e99ca02005dae6c6258f7cd2668493993b8cd6d14f50c15a6f20_amd64",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:55dbe229e33a66b6b9ee53e24b6f7b68ede43a35a58ac19cbe0c28a0197abebe_s390x",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:9614841fac14766d130fb90a18ee53c7c574d1db0ac66aa38a99371af9d51b0c_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ac4c17d41492322051ad844e5df5f5074e59ba5e325ac950baba6c6858589deb_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:01842d2c486065144177385dd635c16ed1fb58aa07f7e2ebab74348c72e644e6_ppc64le",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:ccb65727856c6819aa77024d62f2e34f6d321be8294552a2656acefe5b35dacf_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e2f040db721a21f9e38cd3f4e1c7adc203a0fa89993efde704844d272bdf5b25_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:29942e0de728b77dd24b373e0bf68895a7a96ace0e234d1be15c310752e6d568_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:79903fbe59a799b7756520f0195d9e0cfcf24d6b8526af5d279d27bb0eb25092_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b74a635e4559b00e4608d2141caae3d4489e9fedbd8b39de6a2707377ec8c106_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:02fb719b31e51c10d979ea22442dd8bd1aa89ebe44c844fc33a91c447ba6bbed_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:07f949f97eeb4b8887cccdbb069438810cf4cf923646a12bdac45c8836f6cf22_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7ce8c1ae94a77bcaa8758563ea0e2a6aed3ba207e8703e1f14cb0847a66a6fd2_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:57316a19aefe1f0083542ef4e9e337cd8b580b017885e82e385ef2bd0424fcec_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:9c273c3fd74d4274e27927bf5833b49f0cafb12984de02b5c46d58f2956b1b5d_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:b145e116e22f4bbf6d8b0887211c945b11f54bbbe8a68904bc9ba9b3224c3a9c_ppc64le",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:4ba9a707675ca882261fb4023925e2e662423cc90fe417f6b2cf22d5751bf361_s390x",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:71899ec83a0513267a8d7b1d85a14494e49ecffd5cb52fb3c7716ef75786c18c_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:7cc543fe1d9c614bf36a183aa3e2a8e6d12f3a947512a667f0786f7284d56894_ppc64le",
            "8Base-Quay-3:quay/quay-rhel8@sha256:2a5588311d09e7804562695b8e1005e15c5515a50ba5583892d3cc5ea6bc84ed_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:6b2d915653b789b757f485e3821a6dc78fce8223d96a6ba080db9dfdcf20ed97_s390x",
            "8Base-Quay-3:quay/quay-rhel8@sha256:731d4bc986148da2202be34035da415451577e62b5d597fbed0d668b4f018c88_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jinja2: Jinja has a sandbox breakout through indirect reference to format method"
    }
  ]
}

CVE-2024-45337 (GCVE-0-2024-45337)

Vulnerability from cvelistv5 – Published: 2024-12-11 18:55 – Updated: 2025-02-18 20:48

Title

Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

Summary

Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-1108 - Excessive Reliance on Global Variables

Assigner

References

7 references

URL	Tags
https://github.com/golang/crypto/commit/b4f1988a3…
https://go.dev/cl/635315
https://go.dev/issue/70779
https://groups.google.com/g/golang-announce/c/-nP…
https://pkg.go.dev/vuln/GO-2024-3321
http://www.openwall.com/lists/oss-security/2024/12/11/2
https://security.netapp.com/advisory/ntap-2025013…

Impacted products

1 product

Vendor	Product	Version
golang.org/x/crypto	golang.org/x/crypto/ssh	Affected: 0 , < 0.31.0 (semver)

Credits

Damien Tournoud (Platform.sh / Upsun) Patrick Dawkins (Platform.sh / Upsun) Vince Parker (Platform.sh / Upsun) Jules Duvivier (Platform.sh / Upsun)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-01-31T15:02:46.088Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/12/11/2"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20250131-0007/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-45337",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-12T17:57:55.896008Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-12T17:58:29.810Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/crypto/ssh",
          "product": "golang.org/x/crypto/ssh",
          "programRoutines": [
            {
              "name": "ServerConfig.PublicKeyCallback"
            },
            {
              "name": "connection.serverAuthenticate"
            },
            {
              "name": "NewServerConn"
            }
          ],
          "vendor": "golang.org/x/crypto",
          "versions": [
            {
              "lessThan": "0.31.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Damien Tournoud (Platform.sh / Upsun)"
        },
        {
          "lang": "en",
          "value": "Patrick Dawkins (Platform.sh / Upsun)"
        },
        {
          "lang": "en",
          "value": "Vince Parker (Platform.sh / Upsun)"
        },
        {
          "lang": "en",
          "value": "Jules Duvivier (Platform.sh / Upsun)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1108: Excessive Reliance on Global Variables",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-18T20:48:40.404Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909"
        },
        {
          "url": "https://go.dev/cl/635315"
        },
        {
          "url": "https://go.dev/issue/70779"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-3321"
        }
      ],
      "title": "Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2024-45337",
    "datePublished": "2024-12-11T18:55:58.506Z",
    "dateReserved": "2024-08-27T19:41:58.555Z",
    "dateUpdated": "2025-02-18T20:48:40.404Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-56201 (GCVE-0-2024-56201)

Vulnerability from cvelistv5 – Published: 2024-12-23 15:37 – Updated: 2025-02-18 21:47

Title

Jinja has a sandbox breakout through malicious filenames

Summary

Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.

Severity

5.4 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/pallets/jinja/security/advisor…	x_refsource_CONFIRM
https://github.com/pallets/jinja/issues/1792	x_refsource_MISC
https://github.com/pallets/jinja/commit/767b23617…	x_refsource_MISC
https://github.com/pallets/jinja/releases/tag/3.1.5	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pallets	jinja	Affected: >= 3.0.0, < 3.1.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-56201",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-24T01:44:55.825619Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-18T21:47:42.763Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jinja",
          "vendor": "pallets",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja\u0027s sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-08T16:06:29.739Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699"
        },
        {
          "name": "https://github.com/pallets/jinja/issues/1792",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pallets/jinja/issues/1792"
        },
        {
          "name": "https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f"
        },
        {
          "name": "https://github.com/pallets/jinja/releases/tag/3.1.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pallets/jinja/releases/tag/3.1.5"
        }
      ],
      "source": {
        "advisory": "GHSA-gmj6-6f8f-6699",
        "discovery": "UNKNOWN"
      },
      "title": "Jinja has a sandbox breakout through malicious filenames"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-56201",
    "datePublished": "2024-12-23T15:37:36.110Z",
    "dateReserved": "2024-12-18T18:29:25.896Z",
    "dateUpdated": "2025-02-18T21:47:42.763Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-56326 (GCVE-0-2024-56326)

Vulnerability from cvelistv5 – Published: 2024-12-23 15:43 – Updated: 2025-11-03 19:32

Title

Jinja has a sandbox breakout through indirect reference to format method

Summary

Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5.

Severity

5.4 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
CWE-693 - Protection Mechanism Failure

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/pallets/jinja/security/advisor…	x_refsource_CONFIRM
https://github.com/pallets/jinja/commit/48b0687e0…	x_refsource_MISC
https://github.com/pallets/jinja/releases/tag/3.1.5	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
pallets	jinja	Affected: < 3.1.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56326",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-27T17:50:50.460995Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-27T17:54:33.724Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:32:16.045Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jinja",
          "vendor": "pallets",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.1.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja\u0027s sandbox does catch calls to str.format and ensures they don\u0027t escape the sandbox. However, it\u0027s possible to store a reference to a malicious string\u0027s format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1336",
              "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-23T15:43:49.400Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h"
        },
        {
          "name": "https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4"
        },
        {
          "name": "https://github.com/pallets/jinja/releases/tag/3.1.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pallets/jinja/releases/tag/3.1.5"
        }
      ],
      "source": {
        "advisory": "GHSA-q2x7-8rv6-6q7h",
        "discovery": "UNKNOWN"
      },
      "title": "Jinja has a sandbox breakout through indirect reference to format method"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-56326",
    "datePublished": "2024-12-23T15:43:49.400Z",
    "dateReserved": "2024-12-19T18:34:22.764Z",
    "dateUpdated": "2025-11-03T19:32:16.045Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

RHBA-2025:1077

CVE-2024-45337 (GCVE-0-2024-45337)

CVE-2024-56201 (GCVE-0-2024-56201)

CVE-2024-56326 (GCVE-0-2024-56326)

Tags

Sightings

Nomenclature