rhsa-2021_3851
Vulnerability from csaf_redhat
Published
2021-10-14 07:53
Modified
2024-11-05 23:59
Summary
Red Hat Security Advisory: Red Hat 3scale API Management 2.11.0 Release - Container Images

Notes

Topic
Red Hat 3scale API Management 2.11.0 Release - Container Images A security update for Red Hat 3scale API Management is now available from the Red Hat Container Catalog. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability listed as CVE link(s) in the References section.
Details
Red Hat 3scale API Management delivers centralized API management features through a distributed, cloud-hosted layer. It includes built-in features to help in building a more successful API program, including access control, rate limits, payment gateway integration, and developer experience tools. This advisory is intended to use with Container Images, for Red Hat 3scale API Management 2.11.0. Security Fixes: * PT RHOAM: XSS in 3scale at various places (CVE-2021-3442) * aws/aws-sdk-go: CBC padding oracle issue in AWS S3 Crypto SDK for golang (CVE-2020-8911) * aws-sdk-go: In-band key negotiation issue in AWS S3 Crypto SDK for golang (CVE-2020-8912) For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat 3scale API Management 2.11.0 Release - Container Images\nA security update for Red Hat 3scale API Management is now available from the Red Hat Container Catalog.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability listed as CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat 3scale API Management delivers centralized API management features through a distributed, cloud-hosted layer. It includes built-in features to help in building a more successful API program, including access control, rate limits, payment gateway integration, and developer experience tools.\n\nThis advisory is intended to use with Container Images, for Red Hat 3scale API Management 2.11.0.\n\nSecurity Fixes:\n\n* PT RHOAM: XSS in 3scale at various places (CVE-2021-3442)\n\n* aws/aws-sdk-go: CBC padding oracle issue in AWS S3 Crypto SDK for golang (CVE-2020-8911)\n\n* aws-sdk-go: In-band key negotiation issue in AWS S3 Crypto SDK for golang (CVE-2020-8912)\n\nFor more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2021:3851",
        "url": "https://access.redhat.com/errata/RHSA-2021:3851"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1869800",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869800"
      },
      {
        "category": "external",
        "summary": "1869801",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869801"
      },
      {
        "category": "external",
        "summary": "1930083",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1930083"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3851.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat 3scale API Management 2.11.0 Release - Container Images",
    "tracking": {
      "current_release_date": "2024-11-05T23:59:39+00:00",
      "generator": {
        "date": "2024-11-05T23:59:39+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2021:3851",
      "initial_release_date": "2021-10-14T07:53:46+00:00",
      "revision_history": [
        {
          "date": "2021-10-14T07:53:46+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-10-14T07:53:46+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T23:59:39+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat 3Scale AMP 2.11",
                "product": {
                  "name": "Red Hat 3Scale AMP 2.11",
                  "product_id": "8Base-3scale-AMP-2.11-RHEL-8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:3scale_amp:2.11::el8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat 3Scale AMP 2.11",
                "product": {
                  "name": "Red Hat 3Scale AMP 2.11",
                  "product_id": "7Server-RH7-3scale-AMP-2.11",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:3scale_amp:2.11::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "3scale API Management"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
                "product": {
                  "name": "3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
                  "product_id": "3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1?arch=amd64\u0026repository_url=registry.redhat.io/3scale-amp2/apicast-gateway-rhel8\u0026tag=3scale2.11.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
                "product": {
                  "name": "3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
                  "product_id": "3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552?arch=amd64\u0026repository_url=registry.redhat.io/3scale-amp2/backend-rhel8\u0026tag=3scale2.11.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
                "product": {
                  "name": "3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
                  "product_id": "3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba?arch=amd64\u0026repository_url=registry.redhat.io/3scale-amp2/memcached-rhel7\u0026tag=3scale2.11.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
                "product": {
                  "name": "3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
                  "product_id": "3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562?arch=amd64\u0026repository_url=registry.redhat.io/3scale-amp2/system-rhel7\u0026tag=1.15.0-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64",
                "product": {
                  "name": "3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64",
                  "product_id": "3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538?arch=amd64\u0026repository_url=registry.redhat.io/3scale-amp2/zync-rhel8\u0026tag=3scale2.11.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
                "product": {
                  "name": "3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
                  "product_id": "3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a?arch=amd64\u0026repository_url=registry.redhat.io/3scale-amp2/apicast-rhel7-operator-metadata\u0026tag=3scale2.11.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
                "product": {
                  "name": "3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
                  "product_id": "3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d?arch=amd64\u0026repository_url=registry.redhat.io/3scale-amp2/apicast-rhel7-operator\u0026tag=3scale2.11.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
                "product": {
                  "name": "3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
                  "product_id": "3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930?arch=amd64\u0026repository_url=registry.redhat.io/3scale-amp2/3scale-rhel7-operator-metadata\u0026tag=2.11.0-16"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
                "product": {
                  "name": "3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
                  "product_id": "3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8?arch=amd64\u0026repository_url=registry.redhat.io/3scale-amp2/3scale-rhel7-operator\u0026tag=3scale2.11.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
                "product": {
                  "name": "3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
                  "product_id": "3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd?arch=amd64\u0026repository_url=registry.redhat.io/3scale-amp2/toolbox-rhel8\u0026tag=3scale2.11.0"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64 as a component of Red Hat 3Scale AMP 2.11",
          "product_id": "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64"
        },
        "product_reference": "3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
        "relates_to_product_reference": "7Server-RH7-3scale-AMP-2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64 as a component of Red Hat 3Scale AMP 2.11",
          "product_id": "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64"
        },
        "product_reference": "3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
        "relates_to_product_reference": "7Server-RH7-3scale-AMP-2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64 as a component of Red Hat 3Scale AMP 2.11",
          "product_id": "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64"
        },
        "product_reference": "3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
        "relates_to_product_reference": "7Server-RH7-3scale-AMP-2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64 as a component of Red Hat 3Scale AMP 2.11",
          "product_id": "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64"
        },
        "product_reference": "3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
        "relates_to_product_reference": "7Server-RH7-3scale-AMP-2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64 as a component of Red Hat 3Scale AMP 2.11",
          "product_id": "7Server-RH7-3scale-AMP-2.11:3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64"
        },
        "product_reference": "3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
        "relates_to_product_reference": "7Server-RH7-3scale-AMP-2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64 as a component of Red Hat 3Scale AMP 2.11",
          "product_id": "7Server-RH7-3scale-AMP-2.11:3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64"
        },
        "product_reference": "3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
        "relates_to_product_reference": "7Server-RH7-3scale-AMP-2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64 as a component of Red Hat 3Scale AMP 2.11",
          "product_id": "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64"
        },
        "product_reference": "3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
        "relates_to_product_reference": "8Base-3scale-AMP-2.11-RHEL-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64 as a component of Red Hat 3Scale AMP 2.11",
          "product_id": "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64"
        },
        "product_reference": "3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
        "relates_to_product_reference": "8Base-3scale-AMP-2.11-RHEL-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64 as a component of Red Hat 3Scale AMP 2.11",
          "product_id": "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64"
        },
        "product_reference": "3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
        "relates_to_product_reference": "8Base-3scale-AMP-2.11-RHEL-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64 as a component of Red Hat 3Scale AMP 2.11",
          "product_id": "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64"
        },
        "product_reference": "3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64",
        "relates_to_product_reference": "8Base-3scale-AMP-2.11-RHEL-8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-8911",
      "cwe": {
        "id": "CWE-327",
        "name": "Use of a Broken or Risky Cryptographic Algorithm"
      },
      "discovery_date": "2020-08-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1869800"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the AWS S3 Crypto SDK that allows users to encrypt files stored in S3 buckets with AES-CBC, without computing a MAC on the data. This allows for a padding oracle, enabling attackers with both write access to the target S3 bucket and the ability to observe the result of valid decryption attempts to potentially recover original plaintext. This is not an issue if files in S3 buckets are not encrypted with CBC mode, which is disabled in V2 of the AWS S3 Crypto SDK.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "aws/aws-sdk-go: CBC padding oracle issue in AWS S3 Crypto SDK for golang",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The following products include components that use the AWS SDK (aws/aws-sdk-go), however they do not include code that encrypts or decrypts files in S3 buckets (aws/aws-sdk-go/service/s3/s3crypto). The below products are not affected by this flaw:\n* Red Hat Cluster Application Migration\n* Red Hat OpenShift Container Platform\n* Red Hat OpenShift ServiceMesh\n* Red Hat OpenShift Container Storage\n* Red Hat Ceph Storage\n* Red Hat Gluster Storage",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-8911"
        },
        {
          "category": "external",
          "summary": "RHBZ#1869800",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869800"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8911",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-8911"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8911",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8911"
        },
        {
          "category": "external",
          "summary": "https://aws.amazon.com/blogs/developer/updates-to-the-amazon-s3-encryption-client/?s=09",
          "url": "https://aws.amazon.com/blogs/developer/updates-to-the-amazon-s3-encryption-client/?s=09"
        },
        {
          "category": "external",
          "summary": "https://github.com/google/security-research/security/advisories/GHSA-f5pg-7wfw-84q9",
          "url": "https://github.com/google/security-research/security/advisories/GHSA-f5pg-7wfw-84q9"
        }
      ],
      "release_date": "2020-08-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-14T07:53:46+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_3scale_api_management/2.11/html-single/installing_3scale/index",
          "product_ids": [
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3851"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "aws/aws-sdk-go: CBC padding oracle issue in AWS S3 Crypto SDK for golang"
    },
    {
      "cve": "CVE-2020-8912",
      "cwe": {
        "id": "CWE-327",
        "name": "Use of a Broken or Risky Cryptographic Algorithm"
      },
      "discovery_date": "2020-08-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1869801"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the AWS S3 Crypto SDK where algorithm parameters for the data encryption key are not authenticated. This flaw allows attackers with S3 bucket write access to change the negotiated encryption algorithm, potentially providing viable brute force methods to recover plaintext. This is not an issue in V2 of the API or for applications not encrypting files in S3 buckets. The highest threat from this vulnerability is to confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "aws-sdk-go: In-band key negotiation issue in AWS S3 Crypto SDK for golang",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The following products include components that use the AWS SDK (aws/aws-sdk-go), however they do not include code that encrypts or decrypts files in S3 buckets (aws/aws-sdk-go/service/s3/s3crypto). The below products are not affected by this flaw:\n* Red Hat Cluster Application Migration\n* Red Hat OpenShift Container Platform\n* Red Hat OpenShift ServiceMesh\n* Red Hat OpenShift Container Storage\n* Red Hat Ceph Storage\n* Red Hat Gluster Storage",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-8912"
        },
        {
          "category": "external",
          "summary": "RHBZ#1869801",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869801"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8912",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-8912"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8912",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8912"
        },
        {
          "category": "external",
          "summary": "https://aws.amazon.com/blogs/developer/updates-to-the-amazon-s3-encryption-client/?s=09",
          "url": "https://aws.amazon.com/blogs/developer/updates-to-the-amazon-s3-encryption-client/?s=09"
        },
        {
          "category": "external",
          "summary": "https://github.com/google/security-research/security/advisories/GHSA-7f33-f4f5-xwgw",
          "url": "https://github.com/google/security-research/security/advisories/GHSA-7f33-f4f5-xwgw"
        }
      ],
      "release_date": "2020-08-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-14T07:53:46+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_3scale_api_management/2.11/html-single/installing_3scale/index",
          "product_ids": [
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3851"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "aws-sdk-go: In-band key negotiation issue in AWS S3 Crypto SDK for golang"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Siddharth Sharma",
            "Or Asaf"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2021-3442",
      "cwe": {
        "id": "CWE-134",
        "name": "Use of Externally-Controlled Format String"
      },
      "discovery_date": "2021-02-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1930083"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Red Hat OpenShift API Management product. User input is not validated allowing an authenticated user to inject scripts into some text boxes leading to a XSS attack. The highest threat from this vulnerability is to data confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "RHOAM: XSS in 3scale at various places",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-3442"
        },
        {
          "category": "external",
          "summary": "RHBZ#1930083",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1930083"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3442",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-3442"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3442",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3442"
        }
      ],
      "release_date": "2021-07-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-14T07:53:46+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_3scale_api_management/2.11/html-single/installing_3scale/index",
          "product_ids": [
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3851"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "RHOAM: XSS in 3scale at various places"
    },
    {
      "cve": "CVE-2021-3814",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2021-09-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2004322"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in 3scale\u0027s API docs, where it does not validate the access token. In the case of an invalid token, it uses session auth instead. This issue possibly bypasses access controls and permits unauthorized information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "3scale: missing validation of access token",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-3814"
        },
        {
          "category": "external",
          "summary": "RHBZ#2004322",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004322"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3814",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-3814"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3814",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3814"
        }
      ],
      "release_date": "2021-09-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-14T07:53:46+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_3scale_api_management/2.11/html-single/installing_3scale/index",
          "product_ids": [
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3851"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "3scale: missing validation of access token"
    },
    {
      "cve": "CVE-2021-23017",
      "cwe": {
        "id": "CWE-193",
        "name": "Off-by-one Error"
      },
      "discovery_date": "2021-05-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1963121"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot character out of bounds in a heap allocated buffer which can allow overwriting the least significant byte of next heap chunk metadata likely leading to a remote code execution in certain circumstances. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
          "7Server-RH7-3scale-AMP-2.11:3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
          "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-23017"
        },
        {
          "category": "external",
          "summary": "RHBZ#1963121",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1963121"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-23017",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-23017"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-23017",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23017"
        }
      ],
      "release_date": "2021-05-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-14T07:53:46+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_3scale_api_management/2.11/html-single/installing_3scale/index",
          "product_ids": [
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3851"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator-metadata@sha256:a8aee8352e2f1bd426255380412e401a63c76c147d5aab935ba32505487f7930_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/3scale-rhel7-operator@sha256:378a345b2c83f555ea92f975fce102efc1c33ef4fd7c6d904873269246ee57e8_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator-metadata@sha256:dd0064cef53df333a09ffc4157cdc5a0e0b0148387c5398f23fae61955f8d15a_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/apicast-rhel7-operator@sha256:02ff80ca8d2b961aaf446dfe80027e08206a26604af589c7548cf95e6b132d9d_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/memcached-rhel7@sha256:65958dbba946afee77f06d2efab9c1937d15245462da6c946cf61ab76ebd6fba_amd64",
            "7Server-RH7-3scale-AMP-2.11:3scale-amp2/system-rhel7@sha256:c1c740c613c91d90608b4b6f9143ee041e23410205bde9151d50fa8043551562_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/apicast-gateway-rhel8@sha256:73819f2feea258cfd2ef5b80c0fa3792975cf9b80dd0a9d4d087646bb96ef5c1_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/backend-rhel8@sha256:38604edc4bc880063d3fd9bdefd9d18811f6f1e4b50d7778562addc27549f552_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/toolbox-rhel8@sha256:b4da9d36f59f45496f24ef1295b864238595c227c2fd62e7aba5a90900c994cd_amd64",
            "8Base-3scale-AMP-2.11-RHEL-8:3scale-amp2/zync-rhel8@sha256:88b0ba39bbd294dc470920486422f866e652a6850f54f918e84770e7debed538_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.