{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Advanced Cluster Management for Kubernetes 2.1.3 General Availability\nrelease images, which fix several bugs and security issues. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Advanced Cluster Management for Kubernetes 2.1.3 images\n\nRed Hat Advanced Cluster Management for Kubernetes provides the\ncapabilities to address common challenges that administrators and site\nreliability engineers face as they work across a range of public and\nprivate cloud environments. Clusters and applications are all visible and\nmanaged from a single console\u2014with security policy built in.\n\nThis advisory contains the container images for Red Hat Advanced Cluster\nManagement for Kubernetes, which fix several bugs and security issues. See the following Release Notes documentation,\nwhich will be updated shortly for this release, for additional details about this\nrelease:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.1/html/release_notes/\n\nSecurity fix:\n\n* gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation. (CVE-2021-3121)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nBug fixes:\n\n* Moving from Patched ACM 2.1.x CSV to Default Results in Degraded Cluster (BZ #1906142)\n* Managed Cluster in RHACM stays in Pending Import state (BZ#1894778)\n* RHACM 2.1.0 Custom CA/Cert not working with observability component (BZ#1906542) \n* Policy Standards, Categories and Controls value listing is not consistent across pages (BZ#1896399) \n* Page gets blanks when YAML editor is cleared in policy creation page (BZ#1901447) \n* Content for a page with invalid namespace in URL keeps on loading (BZ#1903580)\n* Missing git repo secret causes multicluster-operators-hub-subscription to crash (BZ#1918799)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2021:0607",
        "url": "https://access.redhat.com/errata/RHSA-2021:0607"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2021-3121",
        "url": "https://access.redhat.com/security/cve/CVE-2021-3121"
      },
      {
        "category": "external",
        "summary": "1894778",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1894778"
      },
      {
        "category": "external",
        "summary": "1896399",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1896399"
      },
      {
        "category": "external",
        "summary": "1901447",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901447"
      },
      {
        "category": "external",
        "summary": "1903580",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903580"
      },
      {
        "category": "external",
        "summary": "1906142",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1906142"
      },
      {
        "category": "external",
        "summary": "1906542",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1906542"
      },
      {
        "category": "external",
        "summary": "1916823",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916823"
      },
      {
        "category": "external",
        "summary": "1918799",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1918799"
      },
      {
        "category": "external",
        "summary": "1921650",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921650"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2021/rhsa-2021_0607.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.1.3 security and bug fix update",
    "tracking": {
      "current_release_date": "2024-08-15T09:01:03+00:00",
      "generator": {
        "date": "2024-08-15T09:01:03+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "3.32.0"
        }
      },
      "id": "RHSA-2021:0607",
      "initial_release_date": "2021-02-18T07:16:18+00:00",
      "revision_history": [
        {
          "date": "2021-02-18T07:16:18+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-02-18T07:16:18+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-08-15T09:01:03+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 8",
                "product": {
                  "name": "Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 8",
                  "product_id": "8Base-RHACM-2.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:acm:2.1::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat ACM"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhacm2/acm-must-gather-rhel8@sha256:72cfabf08c1ae3e633bb323f0ec23d14b62551953f1b12f924c593f08f11d616_amd64",
                "product": {
                  "name": "rhacm2/acm-must-gather-rhel8@sha256:72cfabf08c1ae3e633bb323f0ec23d14b62551953f1b12f924c593f08f11d616_amd64",
                  "product_id": "rhacm2/acm-must-gather-rhel8@sha256:72cfabf08c1ae3e633bb323f0ec23d14b62551953f1b12f924c593f08f11d616_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/acm-must-gather-rhel8@sha256:72cfabf08c1ae3e633bb323f0ec23d14b62551953f1b12f924c593f08f11d616?arch=amd64\u0026repository_url=registry.redhat.io/rhacm2/acm-must-gather-rhel8\u0026tag=v2.1.3-3"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/acm-must-gather-rhel8@sha256:72cfabf08c1ae3e633bb323f0ec23d14b62551953f1b12f924c593f08f11d616_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 8",
          "product_id": "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:72cfabf08c1ae3e633bb323f0ec23d14b62551953f1b12f924c593f08f11d616_amd64"
        },
        "product_reference": "rhacm2/acm-must-gather-rhel8@sha256:72cfabf08c1ae3e633bb323f0ec23d14b62551953f1b12f924c593f08f11d616_amd64",
        "relates_to_product_reference": "8Base-RHACM-2.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3121",
      "cwe": {
        "id": "CWE-129",
        "name": "Improper Validation of Array Index"
      },
      "discovery_date": "2021-01-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1921650"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in github.com/gogo/protobuf before 1.3.2 that allows an out-of-bounds access when unmarshalling certain protobuf objects. This flaw allows a remote attacker to send crafted protobuf messages, causing panic and resulting in a denial of service. The highest threat from this vulnerability is to availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM) and Red Hat OpenShift Jaeger (RHOSJ) all include code generated by github.com/gogo/protobuf to parse protobuf messages. However, no component is known to accept protobuf messages from unauthenticated sources, hence this vulnerability is rated Moderate for OCP, OSSM and RHOSJ.\n\nOpenShift Virtualization includes code generated by github.com/gogo/protobuf to parse protobuf messages. However, no component of OpenShift Virtualization is known to accept protobuf messages from unauthenticated sources, hence this vulnerability is rated Moderate.\n\nRed Hat Advanced Cluster Management for Kubernetes (RHACM) includes code generated by github.com/gogo/protobuf to parse protobuf messages. However, no RHACM component is accepting  protobuf messages from unauthenticated sources and are used with a limited scope, hence this vulnerability is rated Moderate for RHACM.\n\nRed Hat Cluster Application Migration (CAM) includes code generated by github.com/gogo/protobuf to parse protobuf messages. However, no CAM component is known to accept protobuf messages from unauthenticated sources, hence this vulnerability is rated Moderate for CAM.\n\nCryostat-2 is affected as it does ship gogo/protobuf library with it\u0027s distribution but the only use for Protobuf would be the Kubernetes/OpenShift API server the operator communicates with and it should be authenticated hence it is affected with Moderate impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:72cfabf08c1ae3e633bb323f0ec23d14b62551953f1b12f924c593f08f11d616_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-3121"
        },
        {
          "category": "external",
          "summary": "RHBZ#1921650",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921650"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3121",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-3121"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3121",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3121"
        }
      ],
      "release_date": "2021-01-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.1/html/install/installing#upgrading-by-using-the-operator",
          "product_ids": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:72cfabf08c1ae3e633bb323f0ec23d14b62551953f1b12f924c593f08f11d616_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:0607"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:72cfabf08c1ae3e633bb323f0ec23d14b62551953f1b12f924c593f08f11d616_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation"
    }
  ]
}