rhsa-2022_6714
Vulnerability from csaf_redhat
Published
2022-09-26 15:26
Modified
2024-11-13 23:49
Summary
Red Hat Security Advisory: RHACS 3.72 enhancement and security update

Notes

Topic
Updated images are now available for Red Hat Advanced Cluster Security for Kubernetes (RHACS). The updated image includes new features and bug fixes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Release of RHACS 3.72 provides these changes: New features * Automatic removal of nonactive clusters from RHACS: RHACS provides the ability to configure your system to automatically remove nonactive clusters from RHACS so that you can monitor active clusters only. * Support for unauthenticated email integration: RHACS now supports unauthenticated SMTP for email integrations. This is insecure and not recommended. * Support for Quay robot accounts: RHACS now supports use of robot accounts in quay.io integrations. You can create robot accounts in Quay that allow you to share credentials for use in multiple repositories. * Ability to view Dockerfile lines in images that introduced components with Common Vulnerabilities and Exposures (CVEs): In the Images view, under Image Findings, you can view individual lines in the Dockerfile that introduced the components that have been identified as containing CVEs. * Network graph improvements: RHACS 3.72 includes some improvements to the Network Graph user interface. Known issue * RHACS shows the wrong severity when two severities exist for a single vulnerability in a single distribution. This issue occurs because RHACS scopes severities by namespace rather than component. There is no workaround. It is anticipated that an upcoming release will include a fix for this issue. (ROX-12527) Bug fixes * Before this update, the steps to configure OpenShift Container Platform OAuth for more than one URI were missing. The documentation has been revised to include instructions for configuring OAuth in OpenShift Container Platform to use more than one URI. For more information, see Creating additional routes for the OpenShift Container Platform OAuth server. (ROX-11296) * Before this update, the autogenerated image integration, such as a Docker registry integration, for a cluster is not deleted when the cluster is removed from Central. This issue is fixed. (ROX-9398) * Before this update, the Image OS policy criteria did not support regular expressions, or regex. However, the documentation indicated that regular expressions were supported. This issue is fixed by adding support for regular expressions for the Image OS policy criteria. (ROX-12301) * Before this update, the syslog integration did not respect a configured TCP proxy. This is now fixed. * Before this update, the scanner-db pod failed to start when a resource quota was set for the stackrox namespace, because the init-db container in the pod did not have any resources assigned to it. The init-db container for ScannerDB now specifies resource requests and limits that match the db container. (ROX-12291) Notable technical changes * Scanning support for Red Hat Enterprise Linux 9: RHEL 9 is now generally available (GA). RHACS 3.72 introduces support for analyzing images built with Red Hat Universal Base Image (UBI) 9 and Red Hat Enterprise Linux (RHEL) 9 RPMs for vulnerabilities. * Policy for CVEs with fixable CVSS of 6 or greater disabled by default: Beginning with this release, the Fixable CVSS >= 6 and Privileged policy is no longer enabled by default for new RHACS installations. The configuration of this policy is not changed when upgrading an existing system. A new policy Privileged Containers with Important and Critical Fixable CVEs, which gives an alert for containers running in privileged mode that have important or critical fixable vulnerabilities, has been added. Security Fix(es) * golang: encoding/pem: fix stack overflow in Decode (CVE-2022-24675) * golang: regexp: stack exhaustion via a deeply nested expression (CVE-2022-24921) * golang: crypto/elliptic: panic caused by oversized scalar (CVE-2022-28327) * golang: syscall: faccessat checks wrong group (CVE-2022-29526) * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated images are now available for Red Hat Advanced Cluster Security for Kubernetes (RHACS). The updated image includes new features and bug fixes.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Release of RHACS 3.72 provides these changes:\n\nNew features\n* Automatic removal of nonactive clusters from RHACS: RHACS provides the ability to configure your system to automatically remove nonactive clusters from RHACS so that you can monitor active clusters only. \n* Support for unauthenticated email integration: RHACS now supports unauthenticated SMTP for email integrations. This is insecure and not recommended.\n* Support for Quay robot accounts: RHACS now supports use of robot accounts in quay.io integrations. You can create robot accounts in Quay that allow you to share credentials for use in multiple repositories.\n* Ability to view Dockerfile lines in images that introduced components with Common Vulnerabilities and Exposures (CVEs): In the Images view, under Image Findings, you can view individual lines in the Dockerfile that introduced the components that have been identified as containing CVEs.\n* Network graph improvements: RHACS 3.72 includes some improvements to the Network Graph user interface.\n\nKnown issue\n* RHACS shows the wrong severity when two severities exist for a single vulnerability in a single distribution. This issue occurs because RHACS scopes severities by namespace rather than component. There is no workaround. It is anticipated that an upcoming release will include a fix for this issue. (ROX-12527)\n\nBug fixes\n* Before this update, the steps to configure OpenShift Container Platform OAuth for more than one URI were missing. The documentation has been revised to include instructions for configuring OAuth in OpenShift Container Platform to use more than one URI. For more information, see Creating additional routes for the OpenShift Container Platform OAuth server. (ROX-11296)\n* Before this update, the autogenerated image integration, such as a Docker registry integration, for a cluster is not deleted when the cluster is removed from Central. This issue is fixed. (ROX-9398)\n* Before this update, the Image OS policy criteria did not support regular expressions, or regex. However, the documentation indicated that regular expressions were supported. This issue is fixed by adding support for regular expressions for the Image OS policy criteria. (ROX-12301)\n* Before this update, the syslog integration did not respect a configured TCP proxy. This is now fixed.\n* Before this update, the scanner-db pod failed to start when a resource quota was set for the stackrox namespace, because the init-db container in the pod did not have any resources assigned to it. The init-db container for ScannerDB now specifies resource requests and limits that match the db container. (ROX-12291)\n\nNotable technical changes\n* Scanning support for Red Hat Enterprise Linux 9: RHEL 9 is now generally available (GA). RHACS 3.72 introduces support for analyzing images built with Red Hat Universal Base Image (UBI) 9 and Red Hat Enterprise Linux (RHEL) 9 RPMs for vulnerabilities.\n* Policy for CVEs with fixable CVSS of 6 or greater disabled by default: Beginning with this release, the Fixable CVSS \u003e= 6 and Privileged policy is no longer enabled by default for new RHACS installations. The configuration of this policy is not changed when upgrading an existing system. A new policy Privileged Containers with Important and Critical Fixable CVEs, which gives an alert for containers running in privileged mode that have important or critical fixable vulnerabilities, has been added.\n\nSecurity Fix(es)\n* golang: encoding/pem: fix stack overflow in Decode (CVE-2022-24675)\n* golang: regexp: stack exhaustion via a deeply nested expression (CVE-2022-24921)\n* golang: crypto/elliptic: panic caused by oversized scalar (CVE-2022-28327)\n* golang: syscall: faccessat checks wrong group (CVE-2022-29526)\n* golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:6714",
        "url": "https://access.redhat.com/errata/RHSA-2022:6714"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://docs.openshift.com/acs/3.72/release_notes/372-release-notes.html",
        "url": "https://docs.openshift.com/acs/3.72/release_notes/372-release-notes.html"
      },
      {
        "category": "external",
        "summary": "2064857",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064857"
      },
      {
        "category": "external",
        "summary": "2077688",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2077688"
      },
      {
        "category": "external",
        "summary": "2077689",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2077689"
      },
      {
        "category": "external",
        "summary": "2084085",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2084085"
      },
      {
        "category": "external",
        "summary": "2107342",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107342"
      },
      {
        "category": "external",
        "summary": "ROX-12799",
        "url": "https://issues.redhat.com/browse/ROX-12799"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6714.json"
      }
    ],
    "title": "Red Hat Security Advisory: RHACS 3.72 enhancement and security update",
    "tracking": {
      "current_release_date": "2024-11-13T23:49:10+00:00",
      "generator": {
        "date": "2024-11-13T23:49:10+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2022:6714",
      "initial_release_date": "2022-09-26T15:26:11+00:00",
      "revision_history": [
        {
          "date": "2022-09-26T15:26:11+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-09-26T15:26:11+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-13T23:49:10+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHACS 3.72 for RHEL 8",
                "product": {
                  "name": "RHACS 3.72 for RHEL 8",
                  "product_id": "8Base-RHACS-3.72",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:advanced_cluster_security:3.72::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Advanced Cluster Security for Kubernetes"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:2083d2a25f1954186a0b06ddde11215b1f21ac819f2fadb5278f2c62aad5324d_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:2083d2a25f1954186a0b06ddde11215b1f21ac819f2fadb5278f2c62aad5324d_amd64",
                  "product_id": "advanced-cluster-security/rhacs-collector-rhel8@sha256:2083d2a25f1954186a0b06ddde11215b1f21ac819f2fadb5278f2c62aad5324d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-collector-rhel8@sha256:2083d2a25f1954186a0b06ddde11215b1f21ac819f2fadb5278f2c62aad5324d?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8\u0026tag=3.72.0-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:abeaab1e57851f3883af18464d85e776c83778a79bdd39e97d67fc05a0bbe87b_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:abeaab1e57851f3883af18464d85e776c83778a79bdd39e97d67fc05a0bbe87b_amd64",
                  "product_id": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:abeaab1e57851f3883af18464d85e776c83778a79bdd39e97d67fc05a0bbe87b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-collector-slim-rhel8@sha256:abeaab1e57851f3883af18464d85e776c83778a79bdd39e97d67fc05a0bbe87b?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-collector-slim-rhel8\u0026tag=3.72.0-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
                  "product_id": "advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-docs-rhel8\u0026tag=3.72.0-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
                  "product_id": "advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8\u0026tag=3.72.0-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:9ec13da5353f1031edc8b84ee17f00fd42c59253b2f402eec0dc5744fac1cbf5_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:9ec13da5353f1031edc8b84ee17f00fd42c59253b2f402eec0dc5744fac1cbf5_amd64",
                  "product_id": "advanced-cluster-security/rhacs-operator-bundle@sha256:9ec13da5353f1031edc8b84ee17f00fd42c59253b2f402eec0dc5744fac1cbf5_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-operator-bundle@sha256:9ec13da5353f1031edc8b84ee17f00fd42c59253b2f402eec0dc5744fac1cbf5?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle\u0026tag=3.72.0-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
                  "product_id": "advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator\u0026tag=3.72.0-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
                  "product_id": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8\u0026tag=3.72.0-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
                  "product_id": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8\u0026tag=3.72.0-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1e1598484dbf95e45e2b6798dc82d5d0f78a82fff0025d61736c7fdc014e915e_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1e1598484dbf95e45e2b6798dc82d5d0f78a82fff0025d61736c7fdc014e915e_amd64",
                  "product_id": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1e1598484dbf95e45e2b6798dc82d5d0f78a82fff0025d61736c7fdc014e915e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-db-rhel8@sha256:1e1598484dbf95e45e2b6798dc82d5d0f78a82fff0025d61736c7fdc014e915e?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8\u0026tag=3.72.0-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8ddb34c4d25fce6e6686a51a3f8482152a48e9f9154a3142983bcdfde66e9a85_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8ddb34c4d25fce6e6686a51a3f8482152a48e9f9154a3142983bcdfde66e9a85_amd64",
                  "product_id": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8ddb34c4d25fce6e6686a51a3f8482152a48e9f9154a3142983bcdfde66e9a85_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-db-slim-rhel8@sha256:8ddb34c4d25fce6e6686a51a3f8482152a48e9f9154a3142983bcdfde66e9a85?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8\u0026tag=3.72.0-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64",
                  "product_id": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8\u0026tag=3.72.0-3"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:2083d2a25f1954186a0b06ddde11215b1f21ac819f2fadb5278f2c62aad5324d_amd64 as a component of RHACS 3.72 for RHEL 8",
          "product_id": "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-rhel8@sha256:2083d2a25f1954186a0b06ddde11215b1f21ac819f2fadb5278f2c62aad5324d_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-collector-rhel8@sha256:2083d2a25f1954186a0b06ddde11215b1f21ac819f2fadb5278f2c62aad5324d_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.72"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:abeaab1e57851f3883af18464d85e776c83778a79bdd39e97d67fc05a0bbe87b_amd64 as a component of RHACS 3.72 for RHEL 8",
          "product_id": "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:abeaab1e57851f3883af18464d85e776c83778a79bdd39e97d67fc05a0bbe87b_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:abeaab1e57851f3883af18464d85e776c83778a79bdd39e97d67fc05a0bbe87b_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.72"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64 as a component of RHACS 3.72 for RHEL 8",
          "product_id": "8Base-RHACS-3.72:advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.72"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64 as a component of RHACS 3.72 for RHEL 8",
          "product_id": "8Base-RHACS-3.72:advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.72"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:9ec13da5353f1031edc8b84ee17f00fd42c59253b2f402eec0dc5744fac1cbf5_amd64 as a component of RHACS 3.72 for RHEL 8",
          "product_id": "8Base-RHACS-3.72:advanced-cluster-security/rhacs-operator-bundle@sha256:9ec13da5353f1031edc8b84ee17f00fd42c59253b2f402eec0dc5744fac1cbf5_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-operator-bundle@sha256:9ec13da5353f1031edc8b84ee17f00fd42c59253b2f402eec0dc5744fac1cbf5_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.72"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64 as a component of RHACS 3.72 for RHEL 8",
          "product_id": "8Base-RHACS-3.72:advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.72"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64 as a component of RHACS 3.72 for RHEL 8",
          "product_id": "8Base-RHACS-3.72:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.72"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1e1598484dbf95e45e2b6798dc82d5d0f78a82fff0025d61736c7fdc014e915e_amd64 as a component of RHACS 3.72 for RHEL 8",
          "product_id": "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1e1598484dbf95e45e2b6798dc82d5d0f78a82fff0025d61736c7fdc014e915e_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1e1598484dbf95e45e2b6798dc82d5d0f78a82fff0025d61736c7fdc014e915e_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.72"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8ddb34c4d25fce6e6686a51a3f8482152a48e9f9154a3142983bcdfde66e9a85_amd64 as a component of RHACS 3.72 for RHEL 8",
          "product_id": "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8ddb34c4d25fce6e6686a51a3f8482152a48e9f9154a3142983bcdfde66e9a85_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8ddb34c4d25fce6e6686a51a3f8482152a48e9f9154a3142983bcdfde66e9a85_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.72"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64 as a component of RHACS 3.72 for RHEL 8",
          "product_id": "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.72"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64 as a component of RHACS 3.72 for RHEL 8",
          "product_id": "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.72"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-24675",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2022-04-21T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-rhel8@sha256:2083d2a25f1954186a0b06ddde11215b1f21ac819f2fadb5278f2c62aad5324d_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:abeaab1e57851f3883af18464d85e776c83778a79bdd39e97d67fc05a0bbe87b_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-operator-bundle@sha256:9ec13da5353f1031edc8b84ee17f00fd42c59253b2f402eec0dc5744fac1cbf5_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1e1598484dbf95e45e2b6798dc82d5d0f78a82fff0025d61736c7fdc014e915e_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8ddb34c4d25fce6e6686a51a3f8482152a48e9f9154a3142983bcdfde66e9a85_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2077688"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow flaw was found in Golang\u0027s library encoding/pem. This flaw allows an attacker to use a large PEM input (more than 5 MB), causing a stack overflow in Decode, which leads to a loss of availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: encoding/pem: fix stack overflow in Decode",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 7, 8 and 9 are affected, because the code-base is affected by this vulnerability.\n\nRed Hat Product Security has rated this issue as having Moderate security impact, and the issue is not currently planned to be addressed in future updates for Red Hat Enterprise Linux 7, hence, marked as Out-of-Support-Scope.\n\nRed Hat Developer Tools - Compilers (go-toolset-1.16-golang \u0026 go-toolset-1.17-golang), ships the vulnerable code and affected by this vulnerability.\n\nFor additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/ and Red Hat Enterprise Linux Life Cycle \u0026 Updates Policy: https://access.redhat.com/support/policy/updates/errata/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64"
        ],
        "known_not_affected": [
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-rhel8@sha256:2083d2a25f1954186a0b06ddde11215b1f21ac819f2fadb5278f2c62aad5324d_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:abeaab1e57851f3883af18464d85e776c83778a79bdd39e97d67fc05a0bbe87b_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-operator-bundle@sha256:9ec13da5353f1031edc8b84ee17f00fd42c59253b2f402eec0dc5744fac1cbf5_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1e1598484dbf95e45e2b6798dc82d5d0f78a82fff0025d61736c7fdc014e915e_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8ddb34c4d25fce6e6686a51a3f8482152a48e9f9154a3142983bcdfde66e9a85_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-24675"
        },
        {
          "category": "external",
          "summary": "RHBZ#2077688",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2077688"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24675",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-24675"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24675",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24675"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/oecdBNLOml8",
          "url": "https://groups.google.com/g/golang-announce/c/oecdBNLOml8"
        }
      ],
      "release_date": "2022-04-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-26T15:26:11+00:00",
          "details": "To take advantage of the new features, bug fixes, and enhancements in RHACS 3.72 you are advised to upgrade to RHACS 3.72.0.",
          "product_ids": [
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6714"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: encoding/pem: fix stack overflow in Decode"
    },
    {
      "cve": "CVE-2022-24921",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2022-03-16T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-rhel8@sha256:2083d2a25f1954186a0b06ddde11215b1f21ac819f2fadb5278f2c62aad5324d_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:abeaab1e57851f3883af18464d85e776c83778a79bdd39e97d67fc05a0bbe87b_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-operator-bundle@sha256:9ec13da5353f1031edc8b84ee17f00fd42c59253b2f402eec0dc5744fac1cbf5_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1e1598484dbf95e45e2b6798dc82d5d0f78a82fff0025d61736c7fdc014e915e_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8ddb34c4d25fce6e6686a51a3f8482152a48e9f9154a3142983bcdfde66e9a85_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2064857"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A stack overflow flaw was found in Golang\u0027s regexp module, which can crash the runtime if the application using regexp accepts very long or arbitrarily long regexps from untrusted sources that have sufficient nesting depths. To exploit this vulnerability, an attacker would need to send large regexps with deep nesting to the application. Triggering this flaw leads to a crash of the runtime, which causes a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: regexp: stack exhaustion via a deeply nested expression",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw has been rated as a Moderate impact flaw because the exploitation of this flaw requires that an affected application accept arbitrarily long regexps from untrusted sources, which has inherent risks (even without this flaw), especially involving impacts to application availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64"
        ],
        "known_not_affected": [
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-rhel8@sha256:2083d2a25f1954186a0b06ddde11215b1f21ac819f2fadb5278f2c62aad5324d_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:abeaab1e57851f3883af18464d85e776c83778a79bdd39e97d67fc05a0bbe87b_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-operator-bundle@sha256:9ec13da5353f1031edc8b84ee17f00fd42c59253b2f402eec0dc5744fac1cbf5_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1e1598484dbf95e45e2b6798dc82d5d0f78a82fff0025d61736c7fdc014e915e_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8ddb34c4d25fce6e6686a51a3f8482152a48e9f9154a3142983bcdfde66e9a85_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-24921"
        },
        {
          "category": "external",
          "summary": "RHBZ#2064857",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064857"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24921",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-24921"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24921",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24921"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk",
          "url": "https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk"
        }
      ],
      "release_date": "2022-03-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-26T15:26:11+00:00",
          "details": "To take advantage of the new features, bug fixes, and enhancements in RHACS 3.72 you are advised to upgrade to RHACS 3.72.0.",
          "product_ids": [
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6714"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: regexp: stack exhaustion via a deeply nested expression"
    },
    {
      "cve": "CVE-2022-28327",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2022-04-21T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-rhel8@sha256:2083d2a25f1954186a0b06ddde11215b1f21ac819f2fadb5278f2c62aad5324d_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:abeaab1e57851f3883af18464d85e776c83778a79bdd39e97d67fc05a0bbe87b_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-operator-bundle@sha256:9ec13da5353f1031edc8b84ee17f00fd42c59253b2f402eec0dc5744fac1cbf5_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1e1598484dbf95e45e2b6798dc82d5d0f78a82fff0025d61736c7fdc014e915e_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8ddb34c4d25fce6e6686a51a3f8482152a48e9f9154a3142983bcdfde66e9a85_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2077689"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An integer overflow flaw was found in Golang\u0027s crypto/elliptic library. This flaw allows an attacker to use a crafted scaler input longer than 32 bytes, causing P256().ScalarMult or P256().ScalarBaseMult to panic, leading to a loss of availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: crypto/elliptic: panic caused by oversized scalar",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 7, 8 and 9 are affected, because the code-base is affected by this vulnerability.\n\nRed Hat Product Security has rated this issue as having Moderate security impact, and the issue is not currently planned to be addressed in future updates for Red Hat Enterprise Linux 7, hence, marked as Out-of-Support-Scope. \n\nRed Hat Developer Tools - Compilers (go-toolset-1.16-golang \u0026 go-toolset-1.17-golang), ships the vulnerable code and affected by this vulnerability.\n\nFor additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/ and Red Hat Enterprise Linux Life Cycle \u0026 Updates Policy: https://access.redhat.com/support/policy/updates/errata/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64"
        ],
        "known_not_affected": [
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-rhel8@sha256:2083d2a25f1954186a0b06ddde11215b1f21ac819f2fadb5278f2c62aad5324d_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:abeaab1e57851f3883af18464d85e776c83778a79bdd39e97d67fc05a0bbe87b_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-operator-bundle@sha256:9ec13da5353f1031edc8b84ee17f00fd42c59253b2f402eec0dc5744fac1cbf5_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1e1598484dbf95e45e2b6798dc82d5d0f78a82fff0025d61736c7fdc014e915e_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8ddb34c4d25fce6e6686a51a3f8482152a48e9f9154a3142983bcdfde66e9a85_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-28327"
        },
        {
          "category": "external",
          "summary": "RHBZ#2077689",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2077689"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-28327",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-28327"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-28327",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28327"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/oecdBNLOml8",
          "url": "https://groups.google.com/g/golang-announce/c/oecdBNLOml8"
        }
      ],
      "release_date": "2022-04-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-26T15:26:11+00:00",
          "details": "To take advantage of the new features, bug fixes, and enhancements in RHACS 3.72 you are advised to upgrade to RHACS 3.72.0.",
          "product_ids": [
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6714"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: crypto/elliptic: panic caused by oversized scalar"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Jo\u00ebl G\u00e4hwiler"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-29526",
      "cwe": {
        "id": "CWE-280",
        "name": "Improper Handling of Insufficient Permissions or Privileges "
      },
      "discovery_date": "2022-05-11T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-rhel8@sha256:2083d2a25f1954186a0b06ddde11215b1f21ac819f2fadb5278f2c62aad5324d_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:abeaab1e57851f3883af18464d85e776c83778a79bdd39e97d67fc05a0bbe87b_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-operator-bundle@sha256:9ec13da5353f1031edc8b84ee17f00fd42c59253b2f402eec0dc5744fac1cbf5_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1e1598484dbf95e45e2b6798dc82d5d0f78a82fff0025d61736c7fdc014e915e_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8ddb34c4d25fce6e6686a51a3f8482152a48e9f9154a3142983bcdfde66e9a85_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2084085"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the syscall.Faccessat function when calling a process by checking the group. This flaw allows an attacker to check the process group permissions rather than a member of the file\u0027s group, affecting system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: syscall: faccessat checks wrong group",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64"
        ],
        "known_not_affected": [
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-rhel8@sha256:2083d2a25f1954186a0b06ddde11215b1f21ac819f2fadb5278f2c62aad5324d_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:abeaab1e57851f3883af18464d85e776c83778a79bdd39e97d67fc05a0bbe87b_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-operator-bundle@sha256:9ec13da5353f1031edc8b84ee17f00fd42c59253b2f402eec0dc5744fac1cbf5_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1e1598484dbf95e45e2b6798dc82d5d0f78a82fff0025d61736c7fdc014e915e_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8ddb34c4d25fce6e6686a51a3f8482152a48e9f9154a3142983bcdfde66e9a85_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-29526"
        },
        {
          "category": "external",
          "summary": "RHBZ#2084085",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2084085"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-29526",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-29526"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-29526",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29526"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU",
          "url": "https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU"
        }
      ],
      "release_date": "2022-05-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-26T15:26:11+00:00",
          "details": "To take advantage of the new features, bug fixes, and enhancements in RHACS 3.72 you are advised to upgrade to RHACS 3.72.0.",
          "product_ids": [
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6714"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: syscall: faccessat checks wrong group"
    },
    {
      "cve": "CVE-2022-30631",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-rhel8@sha256:2083d2a25f1954186a0b06ddde11215b1f21ac819f2fadb5278f2c62aad5324d_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:abeaab1e57851f3883af18464d85e776c83778a79bdd39e97d67fc05a0bbe87b_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-operator-bundle@sha256:9ec13da5353f1031edc8b84ee17f00fd42c59253b2f402eec0dc5744fac1cbf5_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1e1598484dbf95e45e2b6798dc82d5d0f78a82fff0025d61736c7fdc014e915e_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8ddb34c4d25fce6e6686a51a3f8482152a48e9f9154a3142983bcdfde66e9a85_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107342"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: compress/gzip: stack exhaustion in Reader.Read",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64"
        ],
        "known_not_affected": [
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-rhel8@sha256:2083d2a25f1954186a0b06ddde11215b1f21ac819f2fadb5278f2c62aad5324d_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:abeaab1e57851f3883af18464d85e776c83778a79bdd39e97d67fc05a0bbe87b_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-operator-bundle@sha256:9ec13da5353f1031edc8b84ee17f00fd42c59253b2f402eec0dc5744fac1cbf5_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1e1598484dbf95e45e2b6798dc82d5d0f78a82fff0025d61736c7fdc014e915e_amd64",
          "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8ddb34c4d25fce6e6686a51a3f8482152a48e9f9154a3142983bcdfde66e9a85_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30631"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107342",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107342"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30631",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30631"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30631",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30631"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53168",
          "url": "https://go.dev/issue/53168"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-26T15:26:11+00:00",
          "details": "To take advantage of the new features, bug fixes, and enhancements in RHACS 3.72 you are advised to upgrade to RHACS 3.72.0.",
          "product_ids": [
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6714"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-docs-rhel8@sha256:a17be9f88785c32bb6ab598072bae369f392b80037500947af5cd3f174daafe4_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-main-rhel8@sha256:142aeebfd057b8bf0bcc949190887a2fbc5bf160aa38e7ed70baaccf4f1438c3_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-rhel8-operator@sha256:12012f57ce5f5a3198288b21761b046a0090335d36eb5a6425ab547b04a82790_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:aa63f1ec9768107ef8ee6ca951589d3aba4abd0b6ebac17fd730360f06b25f36_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-rhel8@sha256:39076f8d7502262d78176bda06dfa5ed69bd43a42a5cdd431434bad30dd844ba_amd64",
            "8Base-RHACS-3.72:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:dd738be01a9a078d457e76cf54e2e88d112db971542a168cd4b016190cdf00e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: compress/gzip: stack exhaustion in Reader.Read"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.