rhsa-2023_0814
Vulnerability from csaf_redhat
Published
2023-02-20 12:40
Modified
2024-11-22 19:51
Summary
Red Hat Security Advisory: Red Hat build of Cryostat security update

Notes

Topic
Updated Cryostat 2 on RHEL 8 container images are now available
Details
The Cryostat 2 on RHEL 8 container images have been updated to fix "CVE-2022-1996 go-restful: Authorization Bypass Through User-Controlled Key" and to address the following security advisory: RHSA-2023:0625 (see References) Users of Cryostat 2 on RHEL 8 container images are advised to upgrade to these updated images, which contain backported patches to correct these security issues, fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images. You can find images updated by this advisory in Red Hat Container Catalog (see References).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated Cryostat 2 on RHEL 8 container images are now available",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Cryostat 2 on RHEL 8 container images have been updated to fix \"CVE-2022-1996 go-restful: Authorization Bypass Through User-Controlled Key\" and to address the following security advisory: RHSA-2023:0625 (see References)\n\nUsers of Cryostat 2 on RHEL 8 container images are advised to upgrade to these updated images, which contain backported patches to correct these security issues, fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images.\n\nYou can find images updated by this advisory in Red Hat Container Catalog (see References).",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2023:0814",
        "url": "https://access.redhat.com/errata/RHSA-2023:0814"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/errata/RHSA-2023:0625",
        "url": "https://access.redhat.com/errata/RHSA-2023:0625"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/containers",
        "url": "https://access.redhat.com/containers"
      },
      {
        "category": "external",
        "summary": "2094982",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2094982"
      },
      {
        "category": "external",
        "summary": "2161571",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2161571"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0814.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Cryostat security update",
    "tracking": {
      "current_release_date": "2024-11-22T19:51:11+00:00",
      "generator": {
        "date": "2024-11-22T19:51:11+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2023:0814",
      "initial_release_date": "2023-02-20T12:40:17+00:00",
      "revision_history": [
        {
          "date": "2023-02-20T12:40:17+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-02-20T12:40:17+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T19:51:11+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Cryostat 2 on RHEL 8",
                "product": {
                  "name": "Cryostat 2 on RHEL 8",
                  "product_id": "8Base-Cryostat-2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:cryostat:2::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Cryostat"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:475397e4ba392d1bf197280f078b2aa024ee562ab0b4772b15b9fd773f52e716_amd64",
                "product": {
                  "name": "cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:475397e4ba392d1bf197280f078b2aa024ee562ab0b4772b15b9fd773f52e716_amd64",
                  "product_id": "cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:475397e4ba392d1bf197280f078b2aa024ee562ab0b4772b15b9fd773f52e716_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cryostat-grafana-dashboard-rhel8@sha256:475397e4ba392d1bf197280f078b2aa024ee562ab0b4772b15b9fd773f52e716?arch=amd64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/cryostat-grafana-dashboard-rhel8\u0026tag=2.2.0-14"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cryostat-tech-preview/cryostat-reports-rhel8@sha256:3ae672568790ef1d2e0870d4c016186b37365144082920510dbd2426b336a896_amd64",
                "product": {
                  "name": "cryostat-tech-preview/cryostat-reports-rhel8@sha256:3ae672568790ef1d2e0870d4c016186b37365144082920510dbd2426b336a896_amd64",
                  "product_id": "cryostat-tech-preview/cryostat-reports-rhel8@sha256:3ae672568790ef1d2e0870d4c016186b37365144082920510dbd2426b336a896_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cryostat-reports-rhel8@sha256:3ae672568790ef1d2e0870d4c016186b37365144082920510dbd2426b336a896?arch=amd64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/cryostat-reports-rhel8\u0026tag=1.1.1-9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cryostat-tech-preview/cryostat-rhel8@sha256:3bec4e0d5e0e7f0a86374661222e68590f14181f230444a8a042904e772db9db_amd64",
                "product": {
                  "name": "cryostat-tech-preview/cryostat-rhel8@sha256:3bec4e0d5e0e7f0a86374661222e68590f14181f230444a8a042904e772db9db_amd64",
                  "product_id": "cryostat-tech-preview/cryostat-rhel8@sha256:3bec4e0d5e0e7f0a86374661222e68590f14181f230444a8a042904e772db9db_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cryostat-rhel8@sha256:3bec4e0d5e0e7f0a86374661222e68590f14181f230444a8a042904e772db9db?arch=amd64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/cryostat-rhel8\u0026tag=2.2.1-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cryostat-tech-preview/cryostat-operator-bundle@sha256:704d50bc5a2ba7910344e6ec6d30bbabccd560628ac82b89d66f53a2ddf1140e_amd64",
                "product": {
                  "name": "cryostat-tech-preview/cryostat-operator-bundle@sha256:704d50bc5a2ba7910344e6ec6d30bbabccd560628ac82b89d66f53a2ddf1140e_amd64",
                  "product_id": "cryostat-tech-preview/cryostat-operator-bundle@sha256:704d50bc5a2ba7910344e6ec6d30bbabccd560628ac82b89d66f53a2ddf1140e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cryostat-operator-bundle@sha256:704d50bc5a2ba7910344e6ec6d30bbabccd560628ac82b89d66f53a2ddf1140e?arch=amd64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/cryostat-operator-bundle\u0026tag=2.2.1-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cryostat-tech-preview/cryostat-rhel8-operator@sha256:20ab3fc7104fe007eb9d5d0df368b86ed6d01a9cb0c2b4595bcf9b677e7a22f8_amd64",
                "product": {
                  "name": "cryostat-tech-preview/cryostat-rhel8-operator@sha256:20ab3fc7104fe007eb9d5d0df368b86ed6d01a9cb0c2b4595bcf9b677e7a22f8_amd64",
                  "product_id": "cryostat-tech-preview/cryostat-rhel8-operator@sha256:20ab3fc7104fe007eb9d5d0df368b86ed6d01a9cb0c2b4595bcf9b677e7a22f8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cryostat-rhel8-operator@sha256:20ab3fc7104fe007eb9d5d0df368b86ed6d01a9cb0c2b4595bcf9b677e7a22f8?arch=amd64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/cryostat-rhel8-operator\u0026tag=2.2.1-11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cryostat-tech-preview/jfr-datasource-rhel8@sha256:2718b97731f10e50c53a1e86e00d3fbb80a99b7fa0151858a6e355c501e1b392_amd64",
                "product": {
                  "name": "cryostat-tech-preview/jfr-datasource-rhel8@sha256:2718b97731f10e50c53a1e86e00d3fbb80a99b7fa0151858a6e355c501e1b392_amd64",
                  "product_id": "cryostat-tech-preview/jfr-datasource-rhel8@sha256:2718b97731f10e50c53a1e86e00d3fbb80a99b7fa0151858a6e355c501e1b392_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jfr-datasource-rhel8@sha256:2718b97731f10e50c53a1e86e00d3fbb80a99b7fa0151858a6e355c501e1b392?arch=amd64\u0026repository_url=registry.redhat.io/cryostat-tech-preview/jfr-datasource-rhel8\u0026tag=2.2.0-14"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:475397e4ba392d1bf197280f078b2aa024ee562ab0b4772b15b9fd773f52e716_amd64 as a component of Cryostat 2 on RHEL 8",
          "product_id": "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:475397e4ba392d1bf197280f078b2aa024ee562ab0b4772b15b9fd773f52e716_amd64"
        },
        "product_reference": "cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:475397e4ba392d1bf197280f078b2aa024ee562ab0b4772b15b9fd773f52e716_amd64",
        "relates_to_product_reference": "8Base-Cryostat-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cryostat-tech-preview/cryostat-operator-bundle@sha256:704d50bc5a2ba7910344e6ec6d30bbabccd560628ac82b89d66f53a2ddf1140e_amd64 as a component of Cryostat 2 on RHEL 8",
          "product_id": "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:704d50bc5a2ba7910344e6ec6d30bbabccd560628ac82b89d66f53a2ddf1140e_amd64"
        },
        "product_reference": "cryostat-tech-preview/cryostat-operator-bundle@sha256:704d50bc5a2ba7910344e6ec6d30bbabccd560628ac82b89d66f53a2ddf1140e_amd64",
        "relates_to_product_reference": "8Base-Cryostat-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cryostat-tech-preview/cryostat-reports-rhel8@sha256:3ae672568790ef1d2e0870d4c016186b37365144082920510dbd2426b336a896_amd64 as a component of Cryostat 2 on RHEL 8",
          "product_id": "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:3ae672568790ef1d2e0870d4c016186b37365144082920510dbd2426b336a896_amd64"
        },
        "product_reference": "cryostat-tech-preview/cryostat-reports-rhel8@sha256:3ae672568790ef1d2e0870d4c016186b37365144082920510dbd2426b336a896_amd64",
        "relates_to_product_reference": "8Base-Cryostat-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cryostat-tech-preview/cryostat-rhel8-operator@sha256:20ab3fc7104fe007eb9d5d0df368b86ed6d01a9cb0c2b4595bcf9b677e7a22f8_amd64 as a component of Cryostat 2 on RHEL 8",
          "product_id": "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:20ab3fc7104fe007eb9d5d0df368b86ed6d01a9cb0c2b4595bcf9b677e7a22f8_amd64"
        },
        "product_reference": "cryostat-tech-preview/cryostat-rhel8-operator@sha256:20ab3fc7104fe007eb9d5d0df368b86ed6d01a9cb0c2b4595bcf9b677e7a22f8_amd64",
        "relates_to_product_reference": "8Base-Cryostat-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cryostat-tech-preview/cryostat-rhel8@sha256:3bec4e0d5e0e7f0a86374661222e68590f14181f230444a8a042904e772db9db_amd64 as a component of Cryostat 2 on RHEL 8",
          "product_id": "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:3bec4e0d5e0e7f0a86374661222e68590f14181f230444a8a042904e772db9db_amd64"
        },
        "product_reference": "cryostat-tech-preview/cryostat-rhel8@sha256:3bec4e0d5e0e7f0a86374661222e68590f14181f230444a8a042904e772db9db_amd64",
        "relates_to_product_reference": "8Base-Cryostat-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cryostat-tech-preview/jfr-datasource-rhel8@sha256:2718b97731f10e50c53a1e86e00d3fbb80a99b7fa0151858a6e355c501e1b392_amd64 as a component of Cryostat 2 on RHEL 8",
          "product_id": "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:2718b97731f10e50c53a1e86e00d3fbb80a99b7fa0151858a6e355c501e1b392_amd64"
        },
        "product_reference": "cryostat-tech-preview/jfr-datasource-rhel8@sha256:2718b97731f10e50c53a1e86e00d3fbb80a99b7fa0151858a6e355c501e1b392_amd64",
        "relates_to_product_reference": "8Base-Cryostat-2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-1996",
      "cwe": {
        "id": "CWE-639",
        "name": "Authorization Bypass Through User-Controlled Key"
      },
      "discovery_date": "2022-06-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2094982"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in CORS Filter feature from the go-restful package. When a user inputs a domain which is in AllowedDomains, all domains starting with the same pattern are accepted. This issue could allow an attacker to break the CORS policy by allowing any page to make requests and retrieve data on behalf of users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "go-restful: Authorization Bypass Through User-Controlled Key",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The go-restful package is a transitive dependency which is being pulled with k8s.io/api and not directly being used anywhere in OpenShift Container Platform (OCP), OpenShift Container Storage, OpenShift Data Foundation, OpenShift Do and OpenShift Pipelines, hence these components are marked as \u0027Will not fix\u0027 or even \"Not affected\".",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:475397e4ba392d1bf197280f078b2aa024ee562ab0b4772b15b9fd773f52e716_amd64",
          "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:704d50bc5a2ba7910344e6ec6d30bbabccd560628ac82b89d66f53a2ddf1140e_amd64",
          "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:3ae672568790ef1d2e0870d4c016186b37365144082920510dbd2426b336a896_amd64",
          "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:20ab3fc7104fe007eb9d5d0df368b86ed6d01a9cb0c2b4595bcf9b677e7a22f8_amd64",
          "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:3bec4e0d5e0e7f0a86374661222e68590f14181f230444a8a042904e772db9db_amd64",
          "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:2718b97731f10e50c53a1e86e00d3fbb80a99b7fa0151858a6e355c501e1b392_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-1996"
        },
        {
          "category": "external",
          "summary": "RHBZ#2094982",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2094982"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1996",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-1996"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1996",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1996"
        }
      ],
      "release_date": "2022-06-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-02-20T12:40:17+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:475397e4ba392d1bf197280f078b2aa024ee562ab0b4772b15b9fd773f52e716_amd64",
            "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:704d50bc5a2ba7910344e6ec6d30bbabccd560628ac82b89d66f53a2ddf1140e_amd64",
            "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:3ae672568790ef1d2e0870d4c016186b37365144082920510dbd2426b336a896_amd64",
            "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:20ab3fc7104fe007eb9d5d0df368b86ed6d01a9cb0c2b4595bcf9b677e7a22f8_amd64",
            "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:3bec4e0d5e0e7f0a86374661222e68590f14181f230444a8a042904e772db9db_amd64",
            "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:2718b97731f10e50c53a1e86e00d3fbb80a99b7fa0151858a6e355c501e1b392_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0814"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-Cryostat-2:cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:475397e4ba392d1bf197280f078b2aa024ee562ab0b4772b15b9fd773f52e716_amd64",
            "8Base-Cryostat-2:cryostat-tech-preview/cryostat-operator-bundle@sha256:704d50bc5a2ba7910344e6ec6d30bbabccd560628ac82b89d66f53a2ddf1140e_amd64",
            "8Base-Cryostat-2:cryostat-tech-preview/cryostat-reports-rhel8@sha256:3ae672568790ef1d2e0870d4c016186b37365144082920510dbd2426b336a896_amd64",
            "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8-operator@sha256:20ab3fc7104fe007eb9d5d0df368b86ed6d01a9cb0c2b4595bcf9b677e7a22f8_amd64",
            "8Base-Cryostat-2:cryostat-tech-preview/cryostat-rhel8@sha256:3bec4e0d5e0e7f0a86374661222e68590f14181f230444a8a042904e772db9db_amd64",
            "8Base-Cryostat-2:cryostat-tech-preview/jfr-datasource-rhel8@sha256:2718b97731f10e50c53a1e86e00d3fbb80a99b7fa0151858a6e355c501e1b392_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "go-restful: Authorization Bypass Through User-Controlled Key"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.