Vulnerability-Lookup

RHSA-2022_6347

Vulnerability from csaf_redhat - Published: 2022-09-06 14:14 - Updated: 2024-12-17 22:01

Summary

Red Hat Security Advisory: VolSync 0.5 security fixes and updates

Severity

Moderate

Notes

Topic: VolSync v0.5 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: VolSync v0.5 VolSync is a Kubernetes operator that enables asynchronous replication of persistent volumes within a cluster, or across clusters. After deploying the VolSync operator, it can create and maintain copies of your persistent data. For more information about VolSync, see: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/add-ons/add-ons-overview#volsync or the VolSync open source community website at: https://volsync.readthedocs.io/en/stable/. This advisory contains a security fix and updates to the VolSync container images. Security fixes: * CVE-2022-27191 golang: crash in a golang.org/x/crypto/ssh server * CVE-2022-30629 golang: crypto/tls: session tickets lack random ticket_age_add * CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header * CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions * CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip * CVE-2022-30630 golang: io/fs: stack exhaustion in Glob * CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read * CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob * CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal * CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode * CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2022-1705

A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating "chunked" encoding. This issue could allow request smuggling, but only if combined with an intermediate server that also improperly accepts the header as invalid.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Vendor Fix For details on how to install VolSync, refer to: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/add-ons/add-ons-overview#volsync-rsync-rep https://access.redhat.com/errata/RHSA-2022:6347

CVE-2022-1962

A flaw was found in the golang standard library, go/parser. When calling any Parse functions on the Go source code, which contains deeply nested types or declarations, a panic can occur due to stack exhaustion. This issue allows an attacker to impact system availability.

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-1325 - Improperly Controlled Sequential Memory Allocation

CVE-2022-27191

A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to fail authentication with RSA keys to servers that reject signature algorithms based on SHA-2, enabling an attacker to crash the server, resulting in a loss of availability.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

CVE-2022-28131

A flaw was found in golang encoding/xml. When calling Decoder, Skip while parsing a deeply nested XML document, a panic can occur due to stack exhaustion and allows an attacker to impact system availability.

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

CWE-1325 - Improperly Controlled Sequential Memory Allocation

CVE-2022-30629

A flaw was found in the crypto/tls golang package. When session tickets are generated by crypto/tls, it is missing the ticket expiration. This issue may allow an attacker to observe the TLS handshakes to correlate successive connections during session resumption.

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE-331 - Insufficient Entropy

CVE-2022-30630

A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1325 - Improperly Controlled Sequential Memory Allocation

CVE-2022-30631

A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1325 - Improperly Controlled Sequential Memory Allocation

CVE-2022-30632

A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1325 - Improperly Controlled Sequential Memory Allocation

CVE-2022-30633

A flaw was found in golang. Calling Unmarshal on an XML document into a Go struct, which has a nested field that uses the "any" field tag, can cause a panic due to stack exhaustion.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1325 - Improperly Controlled Sequential Memory Allocation

CVE-2022-30635

A flaw was found in golang. When calling Decoder, Decode on a message that contains deeply nested structures, a panic can occur due to stack exhaustion and allows an attacker to impact system availability.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1325 - Improperly Controlled Sequential Memory Allocation

CVE-2022-32148

A flaw was found in net/http/httputil golang package. When httputil.ReverseProxy.ServeHTTP is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy could set the client IP incorrectly. This issue may affect confidentiality.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

References

URL

Category

	https://access.redhat.com/errata/RHSA-2022:6347	self
	https://access.redhat.com/security/updates/classi…	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2064702	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2092793	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2107342	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2107371	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2107374	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2107376	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2107383	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2107386	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2107388	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2107390	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2107392	external
	https://security.access.redhat.com/data/csaf/v2/a…	self
	https://access.redhat.com/security/cve/CVE-2022-1705	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2107374	external
	https://www.cve.org/CVERecord?id=CVE-2022-1705	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-1705	external
	https://go.dev/issue/53188	external
	https://groups.google.com/g/golang-announce/c/nqr…	external
	https://access.redhat.com/security/cve/CVE-2022-1962	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2107376	external
	https://www.cve.org/CVERecord?id=CVE-2022-1962	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-1962	external
	https://go.dev/issue/53616	external
	https://access.redhat.com/security/cve/CVE-2022-27191	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2064702	external
	https://www.cve.org/CVERecord?id=CVE-2022-27191	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-27191	external
	https://groups.google.com/g/golang-announce/c/-cp…	external
	https://access.redhat.com/security/cve/CVE-2022-28131	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2107390	external
	https://www.cve.org/CVERecord?id=CVE-2022-28131	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-28131	external
	https://go.dev/issue/53614	external
	https://access.redhat.com/security/cve/CVE-2022-30629	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2092793	external
	https://www.cve.org/CVERecord?id=CVE-2022-30629	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-30629	external
	https://groups.google.com/g/golang-announce/c/TzI…	external
	https://access.redhat.com/security/cve/CVE-2022-30630	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2107371	external
	https://www.cve.org/CVERecord?id=CVE-2022-30630	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-30630	external
	https://go.dev/issue/53415	external
	https://access.redhat.com/security/cve/CVE-2022-30631	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2107342	external
	https://www.cve.org/CVERecord?id=CVE-2022-30631	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-30631	external
	https://go.dev/issue/53168	external
	https://access.redhat.com/security/cve/CVE-2022-30632	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2107386	external
	https://www.cve.org/CVERecord?id=CVE-2022-30632	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-30632	external
	https://go.dev/issue/53416	external
	https://access.redhat.com/security/cve/CVE-2022-30633	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2107392	external
	https://www.cve.org/CVERecord?id=CVE-2022-30633	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-30633	external
	https://go.dev/issue/53611	external
	https://access.redhat.com/security/cve/CVE-2022-30635	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2107388	external
	https://www.cve.org/CVERecord?id=CVE-2022-30635	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-30635	external
	https://go.dev/issue/53615	external
	https://access.redhat.com/security/cve/CVE-2022-32148	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2107383	external
	https://www.cve.org/CVERecord?id=CVE-2022-32148	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-32148	external
	https://go.dev/issue/53423	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "VolSync v0.5\n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "VolSync v0.5\n\nVolSync is a Kubernetes operator that enables asynchronous replication of\npersistent volumes within a cluster, or across clusters. After deploying\nthe VolSync operator, it can create and maintain copies of your persistent\ndata.\n\nFor more information about VolSync, see:\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/add-ons/add-ons-overview#volsync\nor the VolSync open source community website at:\nhttps://volsync.readthedocs.io/en/stable/.\n\nThis advisory contains a security fix and updates to the VolSync\ncontainer images.\n\nSecurity fixes:\n\n* CVE-2022-27191 golang: crash in a golang.org/x/crypto/ssh server\n\n* CVE-2022-30629 golang: crypto/tls: session tickets lack random ticket_age_add\n\n* CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header\n\n* CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions\n\n* CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip\n\n* CVE-2022-30630 golang: io/fs: stack exhaustion in Glob\n\n* CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read\n\n* CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob\n\n* CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal\n\n* CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode\n\n* CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:6347",
        "url": "https://access.redhat.com/errata/RHSA-2022:6347"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2064702",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064702"
      },
      {
        "category": "external",
        "summary": "2092793",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2092793"
      },
      {
        "category": "external",
        "summary": "2107342",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107342"
      },
      {
        "category": "external",
        "summary": "2107371",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107371"
      },
      {
        "category": "external",
        "summary": "2107374",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107374"
      },
      {
        "category": "external",
        "summary": "2107376",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107376"
      },
      {
        "category": "external",
        "summary": "2107383",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107383"
      },
      {
        "category": "external",
        "summary": "2107386",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107386"
      },
      {
        "category": "external",
        "summary": "2107388",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107388"
      },
      {
        "category": "external",
        "summary": "2107390",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107390"
      },
      {
        "category": "external",
        "summary": "2107392",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107392"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6347.json"
      }
    ],
    "title": "Red Hat Security Advisory: VolSync 0.5 security fixes and updates",
    "tracking": {
      "current_release_date": "2024-12-17T22:01:55+00:00",
      "generator": {
        "date": "2024-12-17T22:01:55+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2022:6347",
      "initial_release_date": "2022-09-06T14:14:15+00:00",
      "revision_history": [
        {
          "date": "2022-09-06T14:14:15+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-09-06T14:14:15+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-17T22:01:55+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
                "product": {
                  "name": "Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
                  "product_id": "8Base-RHACM-2.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:acm:2.6::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat ACM"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x",
                "product": {
                  "name": "rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x",
                  "product_id": "rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440?arch=s390x\u0026repository_url=registry.redhat.io/rhacm2/volsync-rhel8\u0026tag=v0.5.0-20"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
                "product": {
                  "name": "rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
                  "product_id": "rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf?arch=s390x\u0026repository_url=registry.redhat.io/rhacm2/volsync-mover-rclone-rhel8\u0026tag=v0.5.0-21"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
                "product": {
                  "name": "rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
                  "product_id": "rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7?arch=s390x\u0026repository_url=registry.redhat.io/rhacm2/volsync-mover-restic-rhel8\u0026tag=v0.5.0-21"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
                "product": {
                  "name": "rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
                  "product_id": "rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322?arch=s390x\u0026repository_url=registry.redhat.io/rhacm2/volsync-mover-rsync-rhel8\u0026tag=v0.5.0-22"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
                "product": {
                  "name": "rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
                  "product_id": "rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4?arch=s390x\u0026repository_url=registry.redhat.io/rhacm2/volsync-mover-syncthing-rhel8\u0026tag=v0.5.0-17"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
                "product": {
                  "name": "rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
                  "product_id": "rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385?arch=amd64\u0026repository_url=registry.redhat.io/rhacm2/volsync-rhel8\u0026tag=v0.5.0-20"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
                "product": {
                  "name": "rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
                  "product_id": "rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8?arch=amd64\u0026repository_url=registry.redhat.io/rhacm2/volsync-mover-rclone-rhel8\u0026tag=v0.5.0-21"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
                "product": {
                  "name": "rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
                  "product_id": "rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723?arch=amd64\u0026repository_url=registry.redhat.io/rhacm2/volsync-mover-restic-rhel8\u0026tag=v0.5.0-21"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
                "product": {
                  "name": "rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
                  "product_id": "rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7?arch=amd64\u0026repository_url=registry.redhat.io/rhacm2/volsync-mover-rsync-rhel8\u0026tag=v0.5.0-22"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
                "product": {
                  "name": "rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
                  "product_id": "rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656?arch=amd64\u0026repository_url=registry.redhat.io/rhacm2/volsync-mover-syncthing-rhel8\u0026tag=v0.5.0-17"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
                "product": {
                  "name": "rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
                  "product_id": "rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f?arch=amd64\u0026repository_url=registry.redhat.io/rhacm2/volsync-operator-bundle\u0026tag=v0.5.0-25"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
                "product": {
                  "name": "rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
                  "product_id": "rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5?arch=ppc64le\u0026repository_url=registry.redhat.io/rhacm2/volsync-rhel8\u0026tag=v0.5.0-20"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
                "product": {
                  "name": "rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
                  "product_id": "rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1?arch=ppc64le\u0026repository_url=registry.redhat.io/rhacm2/volsync-mover-rclone-rhel8\u0026tag=v0.5.0-21"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
                "product": {
                  "name": "rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
                  "product_id": "rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4?arch=ppc64le\u0026repository_url=registry.redhat.io/rhacm2/volsync-mover-restic-rhel8\u0026tag=v0.5.0-21"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
                "product": {
                  "name": "rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
                  "product_id": "rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6?arch=ppc64le\u0026repository_url=registry.redhat.io/rhacm2/volsync-mover-rsync-rhel8\u0026tag=v0.5.0-22"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
                "product": {
                  "name": "rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
                  "product_id": "rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2?arch=ppc64le\u0026repository_url=registry.redhat.io/rhacm2/volsync-mover-syncthing-rhel8\u0026tag=v0.5.0-17"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
                "product": {
                  "name": "rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
                  "product_id": "rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d?arch=arm64\u0026repository_url=registry.redhat.io/rhacm2/volsync-rhel8\u0026tag=v0.5.0-20"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
                "product": {
                  "name": "rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
                  "product_id": "rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930?arch=arm64\u0026repository_url=registry.redhat.io/rhacm2/volsync-mover-rclone-rhel8\u0026tag=v0.5.0-21"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
                "product": {
                  "name": "rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
                  "product_id": "rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997?arch=arm64\u0026repository_url=registry.redhat.io/rhacm2/volsync-mover-restic-rhel8\u0026tag=v0.5.0-21"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
                "product": {
                  "name": "rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
                  "product_id": "rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45?arch=arm64\u0026repository_url=registry.redhat.io/rhacm2/volsync-mover-rsync-rhel8\u0026tag=v0.5.0-22"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
                "product": {
                  "name": "rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
                  "product_id": "rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304?arch=arm64\u0026repository_url=registry.redhat.io/rhacm2/volsync-mover-syncthing-rhel8\u0026tag=v0.5.0-17"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le"
        },
        "product_reference": "rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64"
        },
        "product_reference": "rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64"
        },
        "product_reference": "rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x"
        },
        "product_reference": "rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64"
        },
        "product_reference": "rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x"
        },
        "product_reference": "rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le"
        },
        "product_reference": "rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64"
        },
        "product_reference": "rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le"
        },
        "product_reference": "rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x"
        },
        "product_reference": "rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64"
        },
        "product_reference": "rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64"
        },
        "product_reference": "rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64"
        },
        "product_reference": "rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le"
        },
        "product_reference": "rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64"
        },
        "product_reference": "rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x"
        },
        "product_reference": "rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64"
        },
        "product_reference": "rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64"
        },
        "product_reference": "rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le"
        },
        "product_reference": "rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64"
        },
        "product_reference": "rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8",
          "product_id": "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
        },
        "product_reference": "rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x",
        "relates_to_product_reference": "8Base-RHACM-2.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-1705",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107374"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating \"chunked\" encoding. This issue could allow request smuggling, but only if combined with an intermediate server that also improperly accepts the header as invalid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/http: improper sanitization of Transfer-Encoding header",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-1705"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107374",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107374"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1705",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-1705"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1705",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1705"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53188",
          "url": "https://go.dev/issue/53188"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-06T14:14:15+00:00",
          "details": "For details on how to install VolSync, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/add-ons/add-ons-overview#volsync-rsync-rep",
          "product_ids": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6347"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: net/http: improper sanitization of Transfer-Encoding header"
    },
    {
      "cve": "CVE-2022-1962",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107376"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the golang standard library, go/parser. When calling any Parse functions on the Go source code, which contains deeply nested types or declarations, a panic can occur due to stack exhaustion. This issue allows an attacker to impact system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: go/parser: stack exhaustion in all Parse* functions",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-1962"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107376",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107376"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1962",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-1962"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1962",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1962"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53616",
          "url": "https://go.dev/issue/53616"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-06T14:14:15+00:00",
          "details": "For details on how to install VolSync, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/add-ons/add-ons-overview#volsync-rsync-rep",
          "product_ids": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6347"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: go/parser: stack exhaustion in all Parse* functions"
    },
    {
      "cve": "CVE-2022-27191",
      "cwe": {
        "id": "CWE-327",
        "name": "Use of a Broken or Risky Cryptographic Algorithm"
      },
      "discovery_date": "2022-03-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2064702"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to fail authentication with RSA keys to servers that reject signature algorithms based on SHA-2, enabling an attacker to crash the server, resulting in a loss of availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: crash in a golang.org/x/crypto/ssh server",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In OpenShift Container Platform (OCP) the vulnerable golang.org/x/crypto/ssh package is bundled in many components. The affected code is in the SSH server portion that is not used, hence the impact by this vulnerability is reduced. Additionally the OCP installer components, that also bundle vulnerable golang.org/x/crypto/ssh package, are used only during the cluster installation process, hence for already deployed and running OCP clusters the installer components are considered as affected by this vulnerability but not impacted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-27191"
        },
        {
          "category": "external",
          "summary": "RHBZ#2064702",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064702"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-27191",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-27191"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-27191",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27191"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/-cp44ypCT5s/m/wmegxkLiAQAJ",
          "url": "https://groups.google.com/g/golang-announce/c/-cp44ypCT5s/m/wmegxkLiAQAJ"
        }
      ],
      "release_date": "2022-03-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-06T14:14:15+00:00",
          "details": "For details on how to install VolSync, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/add-ons/add-ons-overview#volsync-rsync-rep",
          "product_ids": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6347"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: crash in a golang.org/x/crypto/ssh server"
    },
    {
      "cve": "CVE-2022-28131",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107390"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang encoding/xml. When calling Decoder, Skip while parsing a deeply nested XML document, a panic can occur due to stack exhaustion and allows an attacker to impact system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: encoding/xml: stack exhaustion in Decoder.Skip",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-28131"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107390",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107390"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-28131",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-28131"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-28131",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28131"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53614",
          "url": "https://go.dev/issue/53614"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-06T14:14:15+00:00",
          "details": "For details on how to install VolSync, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/add-ons/add-ons-overview#volsync-rsync-rep",
          "product_ids": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6347"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: encoding/xml: stack exhaustion in Decoder.Skip"
    },
    {
      "cve": "CVE-2022-30629",
      "cwe": {
        "id": "CWE-331",
        "name": "Insufficient Entropy"
      },
      "discovery_date": "2022-06-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2092793"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the crypto/tls golang package. When session tickets are generated by crypto/tls, it is missing the ticket expiration. This issue may allow an attacker to observe the TLS handshakes to correlate successive connections during session resumption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: crypto/tls: session tickets lack random ticket_age_add",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30629"
        },
        {
          "category": "external",
          "summary": "RHBZ#2092793",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2092793"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30629",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30629"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30629",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30629"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg",
          "url": "https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg"
        }
      ],
      "release_date": "2022-06-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-06T14:14:15+00:00",
          "details": "For details on how to install VolSync, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/add-ons/add-ons-overview#volsync-rsync-rep",
          "product_ids": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6347"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "golang: crypto/tls: session tickets lack random ticket_age_add"
    },
    {
      "cve": "CVE-2022-30630",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107371"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: io/fs: stack exhaustion in Glob",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30630"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107371",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107371"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30630",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30630"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30630",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30630"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53415",
          "url": "https://go.dev/issue/53415"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-06T14:14:15+00:00",
          "details": "For details on how to install VolSync, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/add-ons/add-ons-overview#volsync-rsync-rep",
          "product_ids": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6347"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: io/fs: stack exhaustion in Glob"
    },
    {
      "cve": "CVE-2022-30631",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107342"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: compress/gzip: stack exhaustion in Reader.Read",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30631"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107342",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107342"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30631",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30631"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30631",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30631"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53168",
          "url": "https://go.dev/issue/53168"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-06T14:14:15+00:00",
          "details": "For details on how to install VolSync, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/add-ons/add-ons-overview#volsync-rsync-rep",
          "product_ids": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6347"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: compress/gzip: stack exhaustion in Reader.Read"
    },
    {
      "cve": "CVE-2022-30632",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107386"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: path/filepath: stack exhaustion in Glob",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30632"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107386",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107386"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30632",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30632"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30632",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30632"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53416",
          "url": "https://go.dev/issue/53416"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-06T14:14:15+00:00",
          "details": "For details on how to install VolSync, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/add-ons/add-ons-overview#volsync-rsync-rep",
          "product_ids": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6347"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: path/filepath: stack exhaustion in Glob"
    },
    {
      "cve": "CVE-2022-30633",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107392"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang. Calling Unmarshal on an XML document into a Go struct, which has a nested field that uses the \"any\" field tag, can cause a panic due to stack exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: encoding/xml: stack exhaustion in Unmarshal",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30633"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107392",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107392"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30633",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30633"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30633",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30633"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53611",
          "url": "https://go.dev/issue/53611"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-06T14:14:15+00:00",
          "details": "For details on how to install VolSync, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/add-ons/add-ons-overview#volsync-rsync-rep",
          "product_ids": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6347"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: encoding/xml: stack exhaustion in Unmarshal"
    },
    {
      "cve": "CVE-2022-30635",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107388"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang. When calling Decoder, Decode on a message that contains deeply nested structures, a panic can occur due to stack exhaustion and allows an attacker to impact system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: encoding/gob: stack exhaustion in Decoder.Decode",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) starting from 4.10 stream is already compiled in the patched version of Go, hence is not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30635"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107388",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107388"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30635",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30635"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30635",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30635"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53615",
          "url": "https://go.dev/issue/53615"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-06T14:14:15+00:00",
          "details": "For details on how to install VolSync, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/add-ons/add-ons-overview#volsync-rsync-rep",
          "product_ids": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6347"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: encoding/gob: stack exhaustion in Decoder.Decode"
    },
    {
      "cve": "CVE-2022-32148",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107383"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in net/http/httputil golang package. When httputil.ReverseProxy.ServeHTTP is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy could set the client IP incorrectly. This issue may affect confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
          "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
          "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-32148"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107383",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107383"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-32148",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-32148"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-32148",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32148"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53423",
          "url": "https://go.dev/issue/53423"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-06T14:14:15+00:00",
          "details": "For details on how to install VolSync, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/add-ons/add-ons-overview#volsync-rsync-rep",
          "product_ids": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6347"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:0432e656141b9b96c4abe83a319728ee425ecc38b612339b7e746eeab3fa6eb1_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:38e0d652b99dfa8e1fbf2160c931c91fcafe2115025d21cad8349bf3b32a52e8_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:8355564bbddbc0474957b06509dff1b0af5d903572362f8a37bdf0a0785fb930_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rclone-rhel8@sha256:cdd1849150705a02385d68a1ea6063243c28a1d0cacbb3ccf7b4844df82b17cf_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:6d7f6d469d82cbb09a13b508917b555b40075a191e58d5c6ab78b39f98b2d723_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:af340c16f263cc22201539b46aa190be5bdad9700c41093cd30822b0503118c7_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:bcba5128ef35f15470966ecf5fd6371070949faa1375e930de6208d256bb5aa4_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-restic-rhel8@sha256:d1e0fb45b4337dbe141e22b1ad1c3aaf21acad1349644b4f51df35c76ea77997_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:1b4996edfec9ad6bc81d4637797429866454b49d0e19a4181bcd76deed6db5c6_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6c02663d7d04e79c26c8d2b8d6ba6d71c19b85062cb7d1c39c9b2277cc503322_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:6e4e7c4eb153e91c735917dcd6f06f4453c9962a7697ffa40cad941f8b870b45_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-rsync-rhel8@sha256:cfb59342191cc8986ad308670a34f74aceae39329e085d27917aa5ff8d2631a7_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:1c3f96c2e7787b5d2c3c48c66a54fa952a59b82dbe119b8f4506279d2ae75304_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:457e145404b67acbb681a2432401d6de0a587bf7d844c86d6539dc2605ed87f2_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:5c6b0466ac9be0293edd8d55f43fe3b9ae5e833a223af33c29b7338c8a47d656_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-mover-syncthing-rhel8@sha256:e4485e9a91a9ab3494ca1fdb0779e8a03a88b846bf4df3b5f34c5fa7b2714bf4_s390x",
            "8Base-RHACM-2.6:rhacm2/volsync-operator-bundle@sha256:39f804bbf41c5165b84e06cc15f753a85fe11bf37706f0147a4345a9e8d0488f_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:01a39318c761d435e1cc91837fb017014f5bd7f3fa43f3859fe0b8071e56a385_amd64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:2d1b6bbc13629367ed2cbd0a551e9aa8732f330673d70c0bc8c3ce16049a4ae5_ppc64le",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:a90ddd406a30d9a95cfd27f002d133dfc6042309815a9d850cdd36cc788e932d_arm64",
            "8Base-RHACM-2.6:rhacm2/volsync-rhel8@sha256:d6780a0a1cf868d6f65f19daf6e9e6ed9ee08b48694fd5f3827ba70714ca7440_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working"
    }
  ]
}

CVE-2022-28131 (GCVE-0-2022-28131)

Vulnerability from cvelistv5 – Published: 2022-08-09 00:00 – Updated: 2024-08-03 05:48

Title

Stack exhaustion from deeply nested XML documents in encoding/xml

Summary

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

Severity ?

No CVSS data available.

CWE

CWE-674 - Uncontrolled Recursion

Assigner

References

URL

Tags

	https://go.dev/cl/417062
	https://go.googlesource.com/go/+/08c46ed43d80bbb6…
	https://go.dev/issue/53614
	https://groups.google.com/g/golang-announce/c/nqr…
	https://pkg.go.dev/vuln/GO-2022-0521

Impacted products

	Vendor	Product	Version
	Go standard library	encoding/xml	Affected: 0 , < 1.17.12 (semver) Affected: 1.18.0-0 , < 1.18.4 (semver)

Credits

Go Security Team Juho Nurminen of Mattermost

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:48:36.830Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/417062"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/08c46ed43d80bbb67cb904944ea3417989be4af3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53614"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0521"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "encoding/xml",
          "product": "encoding/xml",
          "programRoutines": [
            {
              "name": "Decoder.Skip"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Go Security Team"
        },
        {
          "lang": "en",
          "value": "Juho Nurminen of Mattermost"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:35.004Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/417062"
        },
        {
          "url": "https://go.googlesource.com/go/+/08c46ed43d80bbb67cb904944ea3417989be4af3"
        },
        {
          "url": "https://go.dev/issue/53614"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0521"
        }
      ],
      "title": "Stack exhaustion from deeply nested XML documents in encoding/xml"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-28131",
    "datePublished": "2022-08-09T00:00:00.000Z",
    "dateReserved": "2022-03-29T00:00:00.000Z",
    "dateUpdated": "2024-08-03T05:48:36.830Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-30631 (GCVE-0-2022-30631)

Vulnerability from cvelistv5 – Published: 2022-08-09 20:16 – Updated: 2025-10-20 17:51

Title

Stack exhaustion when reading certain archives in compress/gzip

Summary

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-674 - Uncontrolled Recursion

Assigner

References

URL

Tags

	https://go.dev/cl/417067
	https://go.googlesource.com/go/+/b2b8872c876201ea…
	https://go.dev/issue/53168
	https://groups.google.com/g/golang-announce/c/nqr…
	https://pkg.go.dev/vuln/GO-2022-0524

Impacted products

	Vendor	Product	Version
	Go standard library	compress/gzip	Affected: 0 , < 1.17.12 (semver) Affected: 1.18.0-0 , < 1.18.4 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:56:13.231Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/417067"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/b2b8872c876201eac2d0707276c6999ff3eb185e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53168"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0524"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-30631",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-20T17:51:07.776953Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-20T17:51:28.366Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "compress/gzip",
          "product": "compress/gzip",
          "programRoutines": [
            {
              "name": "Reader.Read"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:40.977Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/417067"
        },
        {
          "url": "https://go.googlesource.com/go/+/b2b8872c876201eac2d0707276c6999ff3eb185e"
        },
        {
          "url": "https://go.dev/issue/53168"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0524"
        }
      ],
      "title": "Stack exhaustion when reading certain archives in compress/gzip"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-30631",
    "datePublished": "2022-08-09T20:16:32.000Z",
    "dateReserved": "2022-05-12T00:00:00.000Z",
    "dateUpdated": "2025-10-20T17:51:28.366Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-1962 (GCVE-0-2022-1962)

Vulnerability from cvelistv5 – Published: 2022-08-09 20:18 – Updated: 2026-03-06 19:08

Title

Stack exhaustion due to deeply nested types in go/parser

Summary

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

Severity ?

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-674 - Uncontrolled Recursion

Assigner

References

URL

Tags

	https://go.dev/cl/417063
	https://go.googlesource.com/go/+/695be961d57508da…
	https://go.dev/issue/53616
	https://groups.google.com/g/golang-announce/c/nqr…
	https://pkg.go.dev/vuln/GO-2022-0515

Impacted products

	Vendor	Product	Version
	Go standard library	go/parser	Affected: 0 , < 1.17.12 (semver) Affected: 1.18.0-0 , < 1.18.4 (semver)

Credits

Juho Nurminen of Mattermost

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:24:43.737Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/417063"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/695be961d57508da5a82217f7415200a11845879"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53616"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0515"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-1962",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-24T19:32:02.875913Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-06T19:08:08.543Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "go/parser",
          "product": "go/parser",
          "programRoutines": [
            {
              "name": "ParseFile"
            },
            {
              "name": "ParseExprFrom"
            },
            {
              "name": "parser.tryIdentOrType"
            },
            {
              "name": "parser.parsePrimaryExpr"
            },
            {
              "name": "parser.parseUnaryExpr"
            },
            {
              "name": "parser.parseBinaryExpr"
            },
            {
              "name": "parser.parseIfStmt"
            },
            {
              "name": "parser.parseStmt"
            },
            {
              "name": "resolver.openScope"
            },
            {
              "name": "resolver.closeScope"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Juho Nurminen of Mattermost"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:29.406Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/417063"
        },
        {
          "url": "https://go.googlesource.com/go/+/695be961d57508da5a82217f7415200a11845879"
        },
        {
          "url": "https://go.dev/issue/53616"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0515"
        }
      ],
      "title": "Stack exhaustion due to deeply nested types in go/parser"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-1962",
    "datePublished": "2022-08-09T20:18:18.000Z",
    "dateReserved": "2022-05-31T00:00:00.000Z",
    "dateUpdated": "2026-03-06T19:08:08.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-1705 (GCVE-0-2022-1705)

Vulnerability from cvelistv5 – Published: 2022-08-09 20:16 – Updated: 2026-03-06 17:46

Title

Improper sanitization of Transfer-Encoding headers in net/http

Summary

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Assigner

References

URL

Tags

	https://go.dev/cl/409874
	https://go.googlesource.com/go/+/e5017a93fcde94f0…
	https://go.dev/issue/53188
	https://go.dev/cl/410714
	https://groups.google.com/g/golang-announce/c/nqr…
	https://pkg.go.dev/vuln/GO-2022-0525

Impacted products

	Vendor	Product	Version
	Go standard library	net/http	Affected: 0 , < 1.17.12 (semver) Affected: 1.18.0-0 , < 1.18.4 (semver)

Credits

Zeyu Zhang (https://www.zeyu2001.com/)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:10:03.918Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/409874"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/e5017a93fcde94f09836200bca55324af037ee5f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53188"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/410714"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0525"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-1705",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-24T20:38:47.035806Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-06T17:46:56.094Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "transferReader.parseTransferEncoding"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Zeyu Zhang (https://www.zeyu2001.com/)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request Smuggling\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:43.089Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/409874"
        },
        {
          "url": "https://go.googlesource.com/go/+/e5017a93fcde94f09836200bca55324af037ee5f"
        },
        {
          "url": "https://go.dev/issue/53188"
        },
        {
          "url": "https://go.dev/cl/410714"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0525"
        }
      ],
      "title": "Improper sanitization of Transfer-Encoding headers in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-1705",
    "datePublished": "2022-08-09T20:16:57.000Z",
    "dateReserved": "2022-05-13T00:00:00.000Z",
    "dateUpdated": "2026-03-06T17:46:56.094Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-27191 (GCVE-0-2022-27191)

Vulnerability from cvelistv5 – Published: 2022-03-18 06:03 – Updated: 2024-08-03 05:25

Summary

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://groups.google.com/g/golang-announce	x_refsource_MISC
	https://groups.google.com/g/golang-announce/c/-cp…	x_refsource_CONFIRM
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://security.netapp.com/advisory/ntap-2022042…	x_refsource_CONFIRM
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:25:31.128Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/-cp44ypCT5s"
          },
          {
            "name": "FEDORA-2022-a4c9009f3e",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HHGBEGJ54DZZGTXFUQNS7ZIG3E624YAF/"
          },
          {
            "name": "FEDORA-2022-d37fb34309",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QTFOIDHQRGNI4P6LYN6ILH5G443RYYKB/"
          },
          {
            "name": "FEDORA-2022-3a63897745",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YHYRQB7TRMHDB3NEHW5XBRG7PPMUTPGV/"
          },
          {
            "name": "FEDORA-2022-5cbd6de569",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQNPPQWSTP2IX7SHE6TS4SP4EVMI5EZK/"
          },
          {
            "name": "FEDORA-2022-c87047f163",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220429-0002/"
          },
          {
            "name": "FEDORA-2022-14712f9699",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZ3S7LB65N54HXXBCB67P4TTOHTNPP5O/"
          },
          {
            "name": "FEDORA-2022-08ae2dd481",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZFUNHFHQVJSADNH7EZ3B53CYDZVEEPBP/"
          },
          {
            "name": "FEDORA-2022-5e637f6cc6",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/"
          },
          {
            "name": "FEDORA-2022-fae3ecee19",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/"
          },
          {
            "name": "FEDORA-2022-ba365d3703",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/"
          },
          {
            "name": "FEDORA-2022-30c5ed5625",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-17T03:11:23.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/g/golang-announce"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/g/golang-announce/c/-cp44ypCT5s"
        },
        {
          "name": "FEDORA-2022-a4c9009f3e",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HHGBEGJ54DZZGTXFUQNS7ZIG3E624YAF/"
        },
        {
          "name": "FEDORA-2022-d37fb34309",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QTFOIDHQRGNI4P6LYN6ILH5G443RYYKB/"
        },
        {
          "name": "FEDORA-2022-3a63897745",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YHYRQB7TRMHDB3NEHW5XBRG7PPMUTPGV/"
        },
        {
          "name": "FEDORA-2022-5cbd6de569",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQNPPQWSTP2IX7SHE6TS4SP4EVMI5EZK/"
        },
        {
          "name": "FEDORA-2022-c87047f163",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220429-0002/"
        },
        {
          "name": "FEDORA-2022-14712f9699",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZ3S7LB65N54HXXBCB67P4TTOHTNPP5O/"
        },
        {
          "name": "FEDORA-2022-08ae2dd481",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZFUNHFHQVJSADNH7EZ3B53CYDZVEEPBP/"
        },
        {
          "name": "FEDORA-2022-5e637f6cc6",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/"
        },
        {
          "name": "FEDORA-2022-fae3ecee19",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/"
        },
        {
          "name": "FEDORA-2022-ba365d3703",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/"
        },
        {
          "name": "FEDORA-2022-30c5ed5625",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2022-27191",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/g/golang-announce",
              "refsource": "MISC",
              "url": "https://groups.google.com/g/golang-announce"
            },
            {
              "name": "https://groups.google.com/g/golang-announce/c/-cp44ypCT5s",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/g/golang-announce/c/-cp44ypCT5s"
            },
            {
              "name": "FEDORA-2022-a4c9009f3e",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HHGBEGJ54DZZGTXFUQNS7ZIG3E624YAF/"
            },
            {
              "name": "FEDORA-2022-d37fb34309",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QTFOIDHQRGNI4P6LYN6ILH5G443RYYKB/"
            },
            {
              "name": "FEDORA-2022-3a63897745",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YHYRQB7TRMHDB3NEHW5XBRG7PPMUTPGV/"
            },
            {
              "name": "FEDORA-2022-5cbd6de569",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQNPPQWSTP2IX7SHE6TS4SP4EVMI5EZK/"
            },
            {
              "name": "FEDORA-2022-c87047f163",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220429-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220429-0002/"
            },
            {
              "name": "FEDORA-2022-14712f9699",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZ3S7LB65N54HXXBCB67P4TTOHTNPP5O/"
            },
            {
              "name": "FEDORA-2022-08ae2dd481",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFUNHFHQVJSADNH7EZ3B53CYDZVEEPBP/"
            },
            {
              "name": "FEDORA-2022-5e637f6cc6",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/"
            },
            {
              "name": "FEDORA-2022-fae3ecee19",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/"
            },
            {
              "name": "FEDORA-2022-ba365d3703",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/"
            },
            {
              "name": "FEDORA-2022-30c5ed5625",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-27191",
    "datePublished": "2022-03-18T06:03:34.000Z",
    "dateReserved": "2022-03-15T00:00:00.000Z",
    "dateUpdated": "2024-08-03T05:25:31.128Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-30629 (GCVE-0-2022-30629)

Vulnerability from cvelistv5 – Published: 2022-08-09 20:17 – Updated: 2026-03-06 19:12

Title

Session tickets lack random ticket_age_add in crypto/tls

Summary

Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

Severity ?

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE

CWE-200 - Information Exposure

Assigner

References

URL

Tags

	https://go.dev/cl/405994
	https://go.googlesource.com/go/+/fe4de36198794c44…
	https://go.dev/issue/52814
	https://groups.google.com/g/golang-announce/c/TzI…
	https://pkg.go.dev/vuln/GO-2022-0531

Impacted products

	Vendor	Product	Version
	Go standard library	crypto/tls	Affected: 0 , < 1.17.11 (semver) Affected: 1.18.0-0 , < 1.18.3 (semver)

Credits

Github user @nervuri

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:56:13.230Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/405994"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/fe4de36198794c447fbd9d7cc2d7199a506c76a5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/52814"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0531"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 3.1,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-30629",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-24T20:38:04.620332Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-06T19:12:16.725Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/tls",
          "product": "crypto/tls",
          "programRoutines": [
            {
              "name": "serverHandshakeStateTLS13.sendSessionTickets"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.3",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Github user @nervuri"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200: Information Exposure",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:50.302Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/405994"
        },
        {
          "url": "https://go.googlesource.com/go/+/fe4de36198794c447fbd9d7cc2d7199a506c76a5"
        },
        {
          "url": "https://go.dev/issue/52814"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0531"
        }
      ],
      "title": "Session tickets lack random ticket_age_add in crypto/tls"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-30629",
    "datePublished": "2022-08-09T20:17:31.000Z",
    "dateReserved": "2022-05-12T00:00:00.000Z",
    "dateUpdated": "2026-03-06T19:12:16.725Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-30633 (GCVE-0-2022-30633)

Vulnerability from cvelistv5 – Published: 2022-08-09 20:16 – Updated: 2026-03-09 16:53

Title

Stack exhaustion when unmarshaling certain documents in encoding/xml

Summary

Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-674 - Uncontrolled Recursion

Assigner

References

URL

Tags

	https://go.dev/cl/417061
	https://go.googlesource.com/go/+/c4c1993fd2a5b26f…
	https://go.dev/issue/53611
	https://groups.google.com/g/golang-announce/c/nqr…
	https://pkg.go.dev/vuln/GO-2022-0523

Impacted products

	Vendor	Product	Version
	Go standard library	encoding/xml	Affected: 0 , < 1.17.12 (semver) Affected: 1.18.0-0 , < 1.18.4 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:56:13.196Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/417061"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/c4c1993fd2a5b26fe45c09592af6d3388a3b2e08"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53611"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0523"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-30633",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-09T16:53:05.801155Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-674",
                "description": "CWE-674 Uncontrolled Recursion",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-09T16:53:13.209Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "encoding/xml",
          "product": "encoding/xml",
          "programRoutines": [
            {
              "name": "Decoder.DecodeElement"
            },
            {
              "name": "Decoder.unmarshal"
            },
            {
              "name": "Decoder.unmarshalPath"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the \u0027any\u0027 field tag."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:39.511Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/417061"
        },
        {
          "url": "https://go.googlesource.com/go/+/c4c1993fd2a5b26fe45c09592af6d3388a3b2e08"
        },
        {
          "url": "https://go.dev/issue/53611"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0523"
        }
      ],
      "title": "Stack exhaustion when unmarshaling certain documents in encoding/xml"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-30633",
    "datePublished": "2022-08-09T20:16:19.000Z",
    "dateReserved": "2022-05-12T00:00:00.000Z",
    "dateUpdated": "2026-03-09T16:53:13.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-30635 (GCVE-0-2022-30635)

Vulnerability from cvelistv5 – Published: 2022-08-09 20:16 – Updated: 2026-03-06 17:44

Title

Stack exhaustion when decoding certain messages in encoding/gob

Summary

Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-674 - Uncontrolled Recursion

Assigner

References

URL

Tags

	https://go.dev/cl/417064
	https://go.googlesource.com/go/+/6fa37e98ea4382bf…
	https://go.dev/issue/53615
	https://groups.google.com/g/golang-announce/c/nqr…
	https://pkg.go.dev/vuln/GO-2022-0526

Impacted products

	Vendor	Product	Version
	Go standard library	encoding/gob	Affected: 0 , < 1.17.12 (semver) Affected: 1.18.0-0 , < 1.18.4 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:56:13.235Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/417064"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/6fa37e98ea4382bf881428ee0c150ce591500eb7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53615"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0526"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-30635",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-06T17:44:14.218881Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-674",
                "description": "CWE-674 Uncontrolled Recursion",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-06T17:44:24.600Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "encoding/gob",
          "product": "encoding/gob",
          "programRoutines": [
            {
              "name": "Decoder.decIgnoreOpFor"
            },
            {
              "name": "Decoder.compileIgnoreSingle"
            },
            {
              "name": "Decoder.compileDec"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:46.476Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/417064"
        },
        {
          "url": "https://go.googlesource.com/go/+/6fa37e98ea4382bf881428ee0c150ce591500eb7"
        },
        {
          "url": "https://go.dev/issue/53615"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0526"
        }
      ],
      "title": "Stack exhaustion when decoding certain messages in encoding/gob"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-30635",
    "datePublished": "2022-08-09T20:16:05.000Z",
    "dateReserved": "2022-05-12T00:00:00.000Z",
    "dateUpdated": "2026-03-06T17:44:24.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-30630 (GCVE-0-2022-30630)

Vulnerability from cvelistv5 – Published: 2022-08-09 20:17 – Updated: 2026-03-06 17:48

Title

Stack exhaustion in Glob on certain paths in io/fs

Summary

Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-674 - Uncontrolled Recursion

Assigner

References

URL

Tags

	https://go.dev/cl/417065
	https://go.googlesource.com/go/+/fa2d41d0ca736f3a…
	https://go.dev/issue/53415
	https://groups.google.com/g/golang-announce/c/nqr…
	https://pkg.go.dev/vuln/GO-2022-0527

Impacted products

	Vendor	Product	Version
	Go standard library	io/fs	Affected: 0 , < 1.17.12 (semver) Affected: 1.18.0-0 , < 1.18.4 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:56:12.871Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/417065"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/fa2d41d0ca736f3ad6b200b2a4e134364e9acc59"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53415"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0527"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-30630",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-24T20:38:26.312251Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-06T17:48:19.834Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "io/fs",
          "product": "io/fs",
          "programRoutines": [
            {
              "name": "Glob"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:48.349Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/417065"
        },
        {
          "url": "https://go.googlesource.com/go/+/fa2d41d0ca736f3ad6b200b2a4e134364e9acc59"
        },
        {
          "url": "https://go.dev/issue/53415"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0527"
        }
      ],
      "title": "Stack exhaustion in Glob on certain paths in io/fs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-30630",
    "datePublished": "2022-08-09T20:17:15.000Z",
    "dateReserved": "2022-05-12T00:00:00.000Z",
    "dateUpdated": "2026-03-06T17:48:19.834Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-30632 (GCVE-0-2022-30632)

Vulnerability from cvelistv5 – Published: 2022-08-09 20:15 – Updated: 2024-08-03 06:56

Title

Stack exhaustion on crafted paths in path/filepath

Summary

Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

Severity ?

No CVSS data available.

CWE

CWE-674 - Uncontrolled Recursion

Assigner

References

URL

Tags

	https://go.dev/cl/417066
	https://go.googlesource.com/go/+/ac68c6c683409f98…
	https://go.dev/issue/53416
	https://groups.google.com/g/golang-announce/c/nqr…
	https://pkg.go.dev/vuln/GO-2022-0522

Impacted products

	Vendor	Product	Version
	Go standard library	path/filepath	Affected: 0 , < 1.17.12 (semver) Affected: 1.18.0-0 , < 1.18.4 (semver)

Credits

Juho Nurminen of Mattermost

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:56:13.251Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/417066"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/ac68c6c683409f98250d34ad282b9e1b0c9095ef"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53416"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0522"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "path/filepath",
          "product": "path/filepath",
          "programRoutines": [
            {
              "name": "Glob"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Juho Nurminen of Mattermost"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:36.688Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/417066"
        },
        {
          "url": "https://go.googlesource.com/go/+/ac68c6c683409f98250d34ad282b9e1b0c9095ef"
        },
        {
          "url": "https://go.dev/issue/53416"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0522"
        }
      ],
      "title": "Stack exhaustion on crafted paths in path/filepath"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-30632",
    "datePublished": "2022-08-09T20:15:37.000Z",
    "dateReserved": "2022-05-12T00:00:00.000Z",
    "dateUpdated": "2024-08-03T06:56:13.251Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-32148 (GCVE-0-2022-32148)

Vulnerability from cvelistv5 – Published: 2022-08-09 20:18 – Updated: 2026-03-06 19:06

Title

Exposure of client IP addresses in net/http

Summary

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-200 - Information Exposure

Assigner

References

URL

Tags

	https://go.dev/cl/412857
	https://go.googlesource.com/go/+/b2cc0fecc2ccd80e…
	https://go.dev/issue/53423
	https://groups.google.com/g/golang-announce/c/nqr…
	https://pkg.go.dev/vuln/GO-2022-0520

Impacted products

	Vendor	Product	Version
	Go standard library	net/http	Affected: 0 , < 1.17.12 (semver) Affected: 1.18.0-0 , < 1.18.4 (semver)

Credits

Christian Mehlmauer

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:32:55.971Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/412857"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/b2cc0fecc2ccd80e6d5d16542cc684f97b3a9c8a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53423"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0520"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-32148",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-23T08:15:49.791308Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-06T19:06:52.828Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "Header.Clone"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Christian Mehlmauer"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200: Information Exposure",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:32.608Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/412857"
        },
        {
          "url": "https://go.googlesource.com/go/+/b2cc0fecc2ccd80e6d5d16542cc684f97b3a9c8a"
        },
        {
          "url": "https://go.dev/issue/53423"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0520"
        }
      ],
      "title": "Exposure of client IP addresses in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-32148",
    "datePublished": "2022-08-09T20:18:21.000Z",
    "dateReserved": "2022-05-31T00:00:00.000Z",
    "dateUpdated": "2026-03-06T19:06:52.828Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2022_6347

CVE-2022-28131 (GCVE-0-2022-28131)

CVE-2022-30631 (GCVE-0-2022-30631)

CVE-2022-1962 (GCVE-0-2022-1962)

CVE-2022-1705 (GCVE-0-2022-1705)

CVE-2022-27191 (GCVE-0-2022-27191)

CVE-2022-30629 (GCVE-0-2022-30629)

CVE-2022-30633 (GCVE-0-2022-30633)

CVE-2022-30635 (GCVE-0-2022-30635)

CVE-2022-30630 (GCVE-0-2022-30630)

CVE-2022-30632 (GCVE-0-2022-30632)

CVE-2022-32148 (GCVE-0-2022-32148)

Tags

Sightings

Nomenclature