rhsa-2023_3379
Vulnerability from csaf_redhat
Published
2023-05-31 11:16
Modified
2024-12-17 22:19
Summary
Red Hat Security Advisory: Red Hat Advanced Cluster Security for Kubernetes 3.73 security update

Notes

Topic
Updated images are now available for Red Hat Advanced Cluster Security for Kubernetes (RHACS). The updated image includes security fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
This release of RHACS includes a fix for CVE-2023-24540 by building RHACS with updated Golang.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated images are now available for Red Hat Advanced Cluster Security for\nKubernetes (RHACS). The updated image includes security fixes.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of RHACS includes a fix for CVE-2023-24540 by building RHACS with updated Golang.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2023:3379",
        "url": "https://access.redhat.com/errata/RHSA-2023:3379"
      },
      {
        "category": "external",
        "summary": "https://docs.openshift.com/acs/3.73/release_notes/373-release-notes.html",
        "url": "https://docs.openshift.com/acs/3.73/release_notes/373-release-notes.html"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2196027",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2196027"
      },
      {
        "category": "external",
        "summary": "ROX-17406",
        "url": "https://issues.redhat.com/browse/ROX-17406"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3379.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Advanced Cluster Security for Kubernetes 3.73 security update",
    "tracking": {
      "current_release_date": "2024-12-17T22:19:24+00:00",
      "generator": {
        "date": "2024-12-17T22:19:24+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2023:3379",
      "initial_release_date": "2023-05-31T11:16:56+00:00",
      "revision_history": [
        {
          "date": "2023-05-31T11:16:56+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-05-31T11:16:56+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-17T22:19:24+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHACS 3.73 for RHEL 8",
                "product": {
                  "name": "RHACS 3.73 for RHEL 8",
                  "product_id": "8Base-RHACS-3.73",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:advanced_cluster_security:3.73::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Advanced Cluster Security for Kubernetes"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:a7675ee36f8e523b3d1edcf194104f11a4d48d46f47ca9861dc205124c6074b8_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:a7675ee36f8e523b3d1edcf194104f11a4d48d46f47ca9861dc205124c6074b8_amd64",
                  "product_id": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:a7675ee36f8e523b3d1edcf194104f11a4d48d46f47ca9861dc205124c6074b8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-central-db-rhel8@sha256:a7675ee36f8e523b3d1edcf194104f11a4d48d46f47ca9861dc205124c6074b8?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8\u0026tag=3.73.5-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:d47dec1aea6c8b9c6de911d462a9ac21038c8ac767fe6bad9601250fa444b25a_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:d47dec1aea6c8b9c6de911d462a9ac21038c8ac767fe6bad9601250fa444b25a_amd64",
                  "product_id": "advanced-cluster-security/rhacs-collector-rhel8@sha256:d47dec1aea6c8b9c6de911d462a9ac21038c8ac767fe6bad9601250fa444b25a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-collector-rhel8@sha256:d47dec1aea6c8b9c6de911d462a9ac21038c8ac767fe6bad9601250fa444b25a?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8\u0026tag=3.73.5-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:10210433ac4c2b553f62b8c4bcb724d8cf03580a2e69a7345309bc2885e1ca80_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:10210433ac4c2b553f62b8c4bcb724d8cf03580a2e69a7345309bc2885e1ca80_amd64",
                  "product_id": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:10210433ac4c2b553f62b8c4bcb724d8cf03580a2e69a7345309bc2885e1ca80_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-collector-slim-rhel8@sha256:10210433ac4c2b553f62b8c4bcb724d8cf03580a2e69a7345309bc2885e1ca80?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-collector-slim-rhel8\u0026tag=3.73.5-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-docs-rhel8@sha256:633d4d46676d03efe1cef6f410a2965ea668677a3b56760bcd37e0146329648e_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-docs-rhel8@sha256:633d4d46676d03efe1cef6f410a2965ea668677a3b56760bcd37e0146329648e_amd64",
                  "product_id": "advanced-cluster-security/rhacs-docs-rhel8@sha256:633d4d46676d03efe1cef6f410a2965ea668677a3b56760bcd37e0146329648e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-docs-rhel8@sha256:633d4d46676d03efe1cef6f410a2965ea668677a3b56760bcd37e0146329648e?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-docs-rhel8\u0026tag=3.73.5-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:35ba7b18c1c28ecfa2d09893d805b8ede9cdd3bf38a67de8e4dd7d6b2e3e9383_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:35ba7b18c1c28ecfa2d09893d805b8ede9cdd3bf38a67de8e4dd7d6b2e3e9383_amd64",
                  "product_id": "advanced-cluster-security/rhacs-main-rhel8@sha256:35ba7b18c1c28ecfa2d09893d805b8ede9cdd3bf38a67de8e4dd7d6b2e3e9383_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-main-rhel8@sha256:35ba7b18c1c28ecfa2d09893d805b8ede9cdd3bf38a67de8e4dd7d6b2e3e9383?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8\u0026tag=3.73.5-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:459a8d91beff91638872d377a8b82c279ad2905ce3f4ad4bfc00f6822418ac57_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:459a8d91beff91638872d377a8b82c279ad2905ce3f4ad4bfc00f6822418ac57_amd64",
                  "product_id": "advanced-cluster-security/rhacs-operator-bundle@sha256:459a8d91beff91638872d377a8b82c279ad2905ce3f4ad4bfc00f6822418ac57_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-operator-bundle@sha256:459a8d91beff91638872d377a8b82c279ad2905ce3f4ad4bfc00f6822418ac57?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle\u0026tag=3.73.5-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:b76d0c880313d14551a30ade5b16dea647f22c85bda14d812b92ee9e91464a93_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:b76d0c880313d14551a30ade5b16dea647f22c85bda14d812b92ee9e91464a93_amd64",
                  "product_id": "advanced-cluster-security/rhacs-rhel8-operator@sha256:b76d0c880313d14551a30ade5b16dea647f22c85bda14d812b92ee9e91464a93_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-rhel8-operator@sha256:b76d0c880313d14551a30ade5b16dea647f22c85bda14d812b92ee9e91464a93?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator\u0026tag=3.73.5-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:98d9268f02f64b676b3d92b80c89ae2bdbe3cafe7b32f97b4a70fb0b4d64bea2_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:98d9268f02f64b676b3d92b80c89ae2bdbe3cafe7b32f97b4a70fb0b4d64bea2_amd64",
                  "product_id": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:98d9268f02f64b676b3d92b80c89ae2bdbe3cafe7b32f97b4a70fb0b4d64bea2_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-roxctl-rhel8@sha256:98d9268f02f64b676b3d92b80c89ae2bdbe3cafe7b32f97b4a70fb0b4d64bea2?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8\u0026tag=3.73.5-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:3579e99d2c9afa5b357fb6f1359629a8be4638ff12eaad0c329c4f158bba765f_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:3579e99d2c9afa5b357fb6f1359629a8be4638ff12eaad0c329c4f158bba765f_amd64",
                  "product_id": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:3579e99d2c9afa5b357fb6f1359629a8be4638ff12eaad0c329c4f158bba765f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-rhel8@sha256:3579e99d2c9afa5b357fb6f1359629a8be4638ff12eaad0c329c4f158bba765f?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8\u0026tag=3.73.5-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:bbfd99b311b433bc680f801bab7fa9302cc4afbd6ab1ce178b8d24c1ada8b345_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:bbfd99b311b433bc680f801bab7fa9302cc4afbd6ab1ce178b8d24c1ada8b345_amd64",
                  "product_id": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:bbfd99b311b433bc680f801bab7fa9302cc4afbd6ab1ce178b8d24c1ada8b345_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-db-rhel8@sha256:bbfd99b311b433bc680f801bab7fa9302cc4afbd6ab1ce178b8d24c1ada8b345?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8\u0026tag=3.73.5-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:e63c6c2f890a874413859b8192cf3cd5f058b035789e77f630d4c76b250f27b0_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:e63c6c2f890a874413859b8192cf3cd5f058b035789e77f630d4c76b250f27b0_amd64",
                  "product_id": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:e63c6c2f890a874413859b8192cf3cd5f058b035789e77f630d4c76b250f27b0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-db-slim-rhel8@sha256:e63c6c2f890a874413859b8192cf3cd5f058b035789e77f630d4c76b250f27b0?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8\u0026tag=3.73.5-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:3a565b2d7a6338e41f012642604c1d307ca3e987dfe3788ccfa5c1bedf1cdb87_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:3a565b2d7a6338e41f012642604c1d307ca3e987dfe3788ccfa5c1bedf1cdb87_amd64",
                  "product_id": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:3a565b2d7a6338e41f012642604c1d307ca3e987dfe3788ccfa5c1bedf1cdb87_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-slim-rhel8@sha256:3a565b2d7a6338e41f012642604c1d307ca3e987dfe3788ccfa5c1bedf1cdb87?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8\u0026tag=3.73.5-2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:a7675ee36f8e523b3d1edcf194104f11a4d48d46f47ca9861dc205124c6074b8_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-central-db-rhel8@sha256:a7675ee36f8e523b3d1edcf194104f11a4d48d46f47ca9861dc205124c6074b8_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:a7675ee36f8e523b3d1edcf194104f11a4d48d46f47ca9861dc205124c6074b8_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:d47dec1aea6c8b9c6de911d462a9ac21038c8ac767fe6bad9601250fa444b25a_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-rhel8@sha256:d47dec1aea6c8b9c6de911d462a9ac21038c8ac767fe6bad9601250fa444b25a_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-collector-rhel8@sha256:d47dec1aea6c8b9c6de911d462a9ac21038c8ac767fe6bad9601250fa444b25a_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:10210433ac4c2b553f62b8c4bcb724d8cf03580a2e69a7345309bc2885e1ca80_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:10210433ac4c2b553f62b8c4bcb724d8cf03580a2e69a7345309bc2885e1ca80_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:10210433ac4c2b553f62b8c4bcb724d8cf03580a2e69a7345309bc2885e1ca80_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-docs-rhel8@sha256:633d4d46676d03efe1cef6f410a2965ea668677a3b56760bcd37e0146329648e_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-docs-rhel8@sha256:633d4d46676d03efe1cef6f410a2965ea668677a3b56760bcd37e0146329648e_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-docs-rhel8@sha256:633d4d46676d03efe1cef6f410a2965ea668677a3b56760bcd37e0146329648e_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:35ba7b18c1c28ecfa2d09893d805b8ede9cdd3bf38a67de8e4dd7d6b2e3e9383_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-main-rhel8@sha256:35ba7b18c1c28ecfa2d09893d805b8ede9cdd3bf38a67de8e4dd7d6b2e3e9383_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-main-rhel8@sha256:35ba7b18c1c28ecfa2d09893d805b8ede9cdd3bf38a67de8e4dd7d6b2e3e9383_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:459a8d91beff91638872d377a8b82c279ad2905ce3f4ad4bfc00f6822418ac57_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-operator-bundle@sha256:459a8d91beff91638872d377a8b82c279ad2905ce3f4ad4bfc00f6822418ac57_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-operator-bundle@sha256:459a8d91beff91638872d377a8b82c279ad2905ce3f4ad4bfc00f6822418ac57_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:b76d0c880313d14551a30ade5b16dea647f22c85bda14d812b92ee9e91464a93_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-rhel8-operator@sha256:b76d0c880313d14551a30ade5b16dea647f22c85bda14d812b92ee9e91464a93_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-rhel8-operator@sha256:b76d0c880313d14551a30ade5b16dea647f22c85bda14d812b92ee9e91464a93_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:98d9268f02f64b676b3d92b80c89ae2bdbe3cafe7b32f97b4a70fb0b4d64bea2_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:98d9268f02f64b676b3d92b80c89ae2bdbe3cafe7b32f97b4a70fb0b4d64bea2_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:98d9268f02f64b676b3d92b80c89ae2bdbe3cafe7b32f97b4a70fb0b4d64bea2_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:bbfd99b311b433bc680f801bab7fa9302cc4afbd6ab1ce178b8d24c1ada8b345_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:bbfd99b311b433bc680f801bab7fa9302cc4afbd6ab1ce178b8d24c1ada8b345_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:bbfd99b311b433bc680f801bab7fa9302cc4afbd6ab1ce178b8d24c1ada8b345_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:e63c6c2f890a874413859b8192cf3cd5f058b035789e77f630d4c76b250f27b0_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:e63c6c2f890a874413859b8192cf3cd5f058b035789e77f630d4c76b250f27b0_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:e63c6c2f890a874413859b8192cf3cd5f058b035789e77f630d4c76b250f27b0_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:3579e99d2c9afa5b357fb6f1359629a8be4638ff12eaad0c329c4f158bba765f_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-rhel8@sha256:3579e99d2c9afa5b357fb6f1359629a8be4638ff12eaad0c329c4f158bba765f_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:3579e99d2c9afa5b357fb6f1359629a8be4638ff12eaad0c329c4f158bba765f_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:3a565b2d7a6338e41f012642604c1d307ca3e987dfe3788ccfa5c1bedf1cdb87_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:3a565b2d7a6338e41f012642604c1d307ca3e987dfe3788ccfa5c1bedf1cdb87_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:3a565b2d7a6338e41f012642604c1d307ca3e987dfe3788ccfa5c1bedf1cdb87_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Juho Nurminen"
          ],
          "organization": "Mattermost"
        }
      ],
      "cve": "CVE-2023-24540",
      "cwe": {
        "id": "CWE-176",
        "name": "Improper Handling of Unicode Encoding"
      },
      "discovery_date": "2023-05-07T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-central-db-rhel8@sha256:a7675ee36f8e523b3d1edcf194104f11a4d48d46f47ca9861dc205124c6074b8_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-rhel8@sha256:d47dec1aea6c8b9c6de911d462a9ac21038c8ac767fe6bad9601250fa444b25a_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:10210433ac4c2b553f62b8c4bcb724d8cf03580a2e69a7345309bc2885e1ca80_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-docs-rhel8@sha256:633d4d46676d03efe1cef6f410a2965ea668677a3b56760bcd37e0146329648e_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-operator-bundle@sha256:459a8d91beff91638872d377a8b82c279ad2905ce3f4ad4bfc00f6822418ac57_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-rhel8-operator@sha256:b76d0c880313d14551a30ade5b16dea647f22c85bda14d812b92ee9e91464a93_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:98d9268f02f64b676b3d92b80c89ae2bdbe3cafe7b32f97b4a70fb0b4d64bea2_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:bbfd99b311b433bc680f801bab7fa9302cc4afbd6ab1ce178b8d24c1ada8b345_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:e63c6c2f890a874413859b8192cf3cd5f058b035789e77f630d4c76b250f27b0_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-rhel8@sha256:3579e99d2c9afa5b357fb6f1359629a8be4638ff12eaad0c329c4f158bba765f_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:3a565b2d7a6338e41f012642604c1d307ca3e987dfe3788ccfa5c1bedf1cdb87_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2196027"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang, where not all valid JavaScript white-space characters were considered white space. Due to this issue, templates containing white-space characters outside of the character set \"\\t\\n\\f\\r\\u0020\\u2028\\u2029\" in JavaScript contexts that also contain actions may not be properly sanitized during execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: html/template: improper handling of JavaScript whitespace",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "For Red Hat Enterprise Linux,\n* Conmon uses go in unit testing, but not functionally in the package. Go is used only in test files, hence, not in the actual code, thus, conmon is not affected.\n* The Go templates in Grafana do not contain any javascript. Thus, it is not affected.\n* Ignition does not make use of html/template.\n\nIn Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable golang html/templates to authenticated users only, therefore the impact is low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-main-rhel8@sha256:35ba7b18c1c28ecfa2d09893d805b8ede9cdd3bf38a67de8e4dd7d6b2e3e9383_amd64"
        ],
        "known_not_affected": [
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-central-db-rhel8@sha256:a7675ee36f8e523b3d1edcf194104f11a4d48d46f47ca9861dc205124c6074b8_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-rhel8@sha256:d47dec1aea6c8b9c6de911d462a9ac21038c8ac767fe6bad9601250fa444b25a_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:10210433ac4c2b553f62b8c4bcb724d8cf03580a2e69a7345309bc2885e1ca80_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-docs-rhel8@sha256:633d4d46676d03efe1cef6f410a2965ea668677a3b56760bcd37e0146329648e_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-operator-bundle@sha256:459a8d91beff91638872d377a8b82c279ad2905ce3f4ad4bfc00f6822418ac57_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-rhel8-operator@sha256:b76d0c880313d14551a30ade5b16dea647f22c85bda14d812b92ee9e91464a93_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:98d9268f02f64b676b3d92b80c89ae2bdbe3cafe7b32f97b4a70fb0b4d64bea2_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:bbfd99b311b433bc680f801bab7fa9302cc4afbd6ab1ce178b8d24c1ada8b345_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:e63c6c2f890a874413859b8192cf3cd5f058b035789e77f630d4c76b250f27b0_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-rhel8@sha256:3579e99d2c9afa5b357fb6f1359629a8be4638ff12eaad0c329c4f158bba765f_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:3a565b2d7a6338e41f012642604c1d307ca3e987dfe3788ccfa5c1bedf1cdb87_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-24540"
        },
        {
          "category": "external",
          "summary": "RHBZ#2196027",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2196027"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-24540",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-24540"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24540",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24540"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/59721",
          "url": "https://go.dev/issue/59721"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU",
          "url": "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU"
        }
      ],
      "release_date": "2023-04-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-31T11:16:56+00:00",
          "details": "If you are using an earlier version of RHACS 3.73, you are advised to upgrade to patch release 3.73.5.",
          "product_ids": [
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-main-rhel8@sha256:35ba7b18c1c28ecfa2d09893d805b8ede9cdd3bf38a67de8e4dd7d6b2e3e9383_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:3379"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-central-db-rhel8@sha256:a7675ee36f8e523b3d1edcf194104f11a4d48d46f47ca9861dc205124c6074b8_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-rhel8@sha256:d47dec1aea6c8b9c6de911d462a9ac21038c8ac767fe6bad9601250fa444b25a_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:10210433ac4c2b553f62b8c4bcb724d8cf03580a2e69a7345309bc2885e1ca80_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-docs-rhel8@sha256:633d4d46676d03efe1cef6f410a2965ea668677a3b56760bcd37e0146329648e_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-main-rhel8@sha256:35ba7b18c1c28ecfa2d09893d805b8ede9cdd3bf38a67de8e4dd7d6b2e3e9383_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-operator-bundle@sha256:459a8d91beff91638872d377a8b82c279ad2905ce3f4ad4bfc00f6822418ac57_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-rhel8-operator@sha256:b76d0c880313d14551a30ade5b16dea647f22c85bda14d812b92ee9e91464a93_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:98d9268f02f64b676b3d92b80c89ae2bdbe3cafe7b32f97b4a70fb0b4d64bea2_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:bbfd99b311b433bc680f801bab7fa9302cc4afbd6ab1ce178b8d24c1ada8b345_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:e63c6c2f890a874413859b8192cf3cd5f058b035789e77f630d4c76b250f27b0_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-rhel8@sha256:3579e99d2c9afa5b357fb6f1359629a8be4638ff12eaad0c329c4f158bba765f_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:3a565b2d7a6338e41f012642604c1d307ca3e987dfe3788ccfa5c1bedf1cdb87_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-central-db-rhel8@sha256:a7675ee36f8e523b3d1edcf194104f11a4d48d46f47ca9861dc205124c6074b8_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-rhel8@sha256:d47dec1aea6c8b9c6de911d462a9ac21038c8ac767fe6bad9601250fa444b25a_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:10210433ac4c2b553f62b8c4bcb724d8cf03580a2e69a7345309bc2885e1ca80_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-docs-rhel8@sha256:633d4d46676d03efe1cef6f410a2965ea668677a3b56760bcd37e0146329648e_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-main-rhel8@sha256:35ba7b18c1c28ecfa2d09893d805b8ede9cdd3bf38a67de8e4dd7d6b2e3e9383_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-operator-bundle@sha256:459a8d91beff91638872d377a8b82c279ad2905ce3f4ad4bfc00f6822418ac57_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-rhel8-operator@sha256:b76d0c880313d14551a30ade5b16dea647f22c85bda14d812b92ee9e91464a93_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:98d9268f02f64b676b3d92b80c89ae2bdbe3cafe7b32f97b4a70fb0b4d64bea2_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:bbfd99b311b433bc680f801bab7fa9302cc4afbd6ab1ce178b8d24c1ada8b345_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:e63c6c2f890a874413859b8192cf3cd5f058b035789e77f630d4c76b250f27b0_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-rhel8@sha256:3579e99d2c9afa5b357fb6f1359629a8be4638ff12eaad0c329c4f158bba765f_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:3a565b2d7a6338e41f012642604c1d307ca3e987dfe3788ccfa5c1bedf1cdb87_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang: html/template: improper handling of JavaScript whitespace"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.