rhsa-2023_3813
Vulnerability from csaf_redhat
Published
2023-06-27 11:34
Modified
2024-11-06 03:15
Summary
Red Hat Security Advisory: Migration Toolkit for Runtimes security update

Notes

Topic
An update for mtr-operator-bundle-container, mtr-operator-container, mtr-web-container, and mtr-web-executor-container is now available for Migration Toolkit for Runtimes 1 on RHEL 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Migration Toolkit for Runtimes 1.1.1 Images Security Fix(es): * undertow: Server identity in https connection is not checked by the undertow client (CVE-2022-4492) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for mtr-operator-bundle-container, mtr-operator-container, mtr-web-container, and mtr-web-executor-container is now available for Migration Toolkit for Runtimes 1 on RHEL 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Migration Toolkit for Runtimes 1.1.1 Images\n\nSecurity Fix(es):\n\n* undertow: Server identity in https connection is not checked by the undertow client (CVE-2022-4492)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2023:3813",
        "url": "https://access.redhat.com/errata/RHSA-2023:3813"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2153260",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153260"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3813.json"
      }
    ],
    "title": "Red Hat Security Advisory: Migration Toolkit for Runtimes security update",
    "tracking": {
      "current_release_date": "2024-11-06T03:15:01+00:00",
      "generator": {
        "date": "2024-11-06T03:15:01+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2023:3813",
      "initial_release_date": "2023-06-27T11:34:44+00:00",
      "revision_history": [
        {
          "date": "2023-06-27T11:34:44+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-06-27T11:34:44+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-06T03:15:01+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Migration Toolkit for Runtimes 1 on RHEL 8",
                "product": {
                  "name": "Migration Toolkit for Runtimes 1 on RHEL 8",
                  "product_id": "8Base-MTR-1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Migration Toolkit for Runtimes"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mtr/mtr-operator-bundle@sha256:e43184e29882918430c515933e4669185cb49764bed4ef5da7ce2580f0a79ecd_amd64",
                "product": {
                  "name": "mtr/mtr-operator-bundle@sha256:e43184e29882918430c515933e4669185cb49764bed4ef5da7ce2580f0a79ecd_amd64",
                  "product_id": "mtr/mtr-operator-bundle@sha256:e43184e29882918430c515933e4669185cb49764bed4ef5da7ce2580f0a79ecd_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtr-operator-bundle@sha256:e43184e29882918430c515933e4669185cb49764bed4ef5da7ce2580f0a79ecd?arch=amd64\u0026repository_url=registry.redhat.io/mtr/mtr-operator-bundle\u0026tag=1.1-9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mtr/mtr-rhel8-operator@sha256:93db684ab05b08d7a6b55e19e63934b85a758bc0b29b9c49469278ce9f6b456e_amd64",
                "product": {
                  "name": "mtr/mtr-rhel8-operator@sha256:93db684ab05b08d7a6b55e19e63934b85a758bc0b29b9c49469278ce9f6b456e_amd64",
                  "product_id": "mtr/mtr-rhel8-operator@sha256:93db684ab05b08d7a6b55e19e63934b85a758bc0b29b9c49469278ce9f6b456e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtr-rhel8-operator@sha256:93db684ab05b08d7a6b55e19e63934b85a758bc0b29b9c49469278ce9f6b456e?arch=amd64\u0026repository_url=registry.redhat.io/mtr/mtr-rhel8-operator\u0026tag=1.1-7"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mtr/mtr-web-container-rhel8@sha256:bc3f7a7cda2b40adc2561c3dd7e2193d1da899ad6a499713bf54f4cfa8055f20_amd64",
                "product": {
                  "name": "mtr/mtr-web-container-rhel8@sha256:bc3f7a7cda2b40adc2561c3dd7e2193d1da899ad6a499713bf54f4cfa8055f20_amd64",
                  "product_id": "mtr/mtr-web-container-rhel8@sha256:bc3f7a7cda2b40adc2561c3dd7e2193d1da899ad6a499713bf54f4cfa8055f20_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtr-web-container-rhel8@sha256:bc3f7a7cda2b40adc2561c3dd7e2193d1da899ad6a499713bf54f4cfa8055f20?arch=amd64\u0026repository_url=registry.redhat.io/mtr/mtr-web-container-rhel8\u0026tag=1.1-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mtr/mtr-web-executor-container-rhel8@sha256:be070c36939408f3ebe40612e239be07ea495d3a4f838e84db43e2d73dc3987f_amd64",
                "product": {
                  "name": "mtr/mtr-web-executor-container-rhel8@sha256:be070c36939408f3ebe40612e239be07ea495d3a4f838e84db43e2d73dc3987f_amd64",
                  "product_id": "mtr/mtr-web-executor-container-rhel8@sha256:be070c36939408f3ebe40612e239be07ea495d3a4f838e84db43e2d73dc3987f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtr-web-executor-container-rhel8@sha256:be070c36939408f3ebe40612e239be07ea495d3a4f838e84db43e2d73dc3987f?arch=amd64\u0026repository_url=registry.redhat.io/mtr/mtr-web-executor-container-rhel8\u0026tag=1.1-7"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mtr/mtr-operator-bundle@sha256:6e4522f5ec12c49e5aad88536accb10eef503e1cabc1abad07ae7a746c03c676_arm64",
                "product": {
                  "name": "mtr/mtr-operator-bundle@sha256:6e4522f5ec12c49e5aad88536accb10eef503e1cabc1abad07ae7a746c03c676_arm64",
                  "product_id": "mtr/mtr-operator-bundle@sha256:6e4522f5ec12c49e5aad88536accb10eef503e1cabc1abad07ae7a746c03c676_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtr-operator-bundle@sha256:6e4522f5ec12c49e5aad88536accb10eef503e1cabc1abad07ae7a746c03c676?arch=arm64\u0026repository_url=registry.redhat.io/mtr/mtr-operator-bundle\u0026tag=1.1-9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mtr/mtr-rhel8-operator@sha256:6f2d9ac73482bc381c3f87590954ecb0632ccfe3c50b1f96d9f637d1e60101b3_arm64",
                "product": {
                  "name": "mtr/mtr-rhel8-operator@sha256:6f2d9ac73482bc381c3f87590954ecb0632ccfe3c50b1f96d9f637d1e60101b3_arm64",
                  "product_id": "mtr/mtr-rhel8-operator@sha256:6f2d9ac73482bc381c3f87590954ecb0632ccfe3c50b1f96d9f637d1e60101b3_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtr-rhel8-operator@sha256:6f2d9ac73482bc381c3f87590954ecb0632ccfe3c50b1f96d9f637d1e60101b3?arch=arm64\u0026repository_url=registry.redhat.io/mtr/mtr-rhel8-operator\u0026tag=1.1-7"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mtr/mtr-web-executor-container-rhel8@sha256:dedc08bd847e3dfe8c3789ed17844f15e75edf3a4bf8786f6a7f897f6ca66d7f_arm64",
                "product": {
                  "name": "mtr/mtr-web-executor-container-rhel8@sha256:dedc08bd847e3dfe8c3789ed17844f15e75edf3a4bf8786f6a7f897f6ca66d7f_arm64",
                  "product_id": "mtr/mtr-web-executor-container-rhel8@sha256:dedc08bd847e3dfe8c3789ed17844f15e75edf3a4bf8786f6a7f897f6ca66d7f_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtr-web-executor-container-rhel8@sha256:dedc08bd847e3dfe8c3789ed17844f15e75edf3a4bf8786f6a7f897f6ca66d7f?arch=arm64\u0026repository_url=registry.redhat.io/mtr/mtr-web-executor-container-rhel8\u0026tag=1.1-7"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mtr/mtr-operator-bundle@sha256:70c1c24245ce7975c50055f0a9f616cd9db4a6325c9aadc42e80a7618b7a74dd_ppc64le",
                "product": {
                  "name": "mtr/mtr-operator-bundle@sha256:70c1c24245ce7975c50055f0a9f616cd9db4a6325c9aadc42e80a7618b7a74dd_ppc64le",
                  "product_id": "mtr/mtr-operator-bundle@sha256:70c1c24245ce7975c50055f0a9f616cd9db4a6325c9aadc42e80a7618b7a74dd_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtr-operator-bundle@sha256:70c1c24245ce7975c50055f0a9f616cd9db4a6325c9aadc42e80a7618b7a74dd?arch=ppc64le\u0026repository_url=registry.redhat.io/mtr/mtr-operator-bundle\u0026tag=1.1-9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mtr/mtr-rhel8-operator@sha256:12e80abe7c02cfbd1a179cb304bef58b72729f5821113c98e2230dda517ef4ec_ppc64le",
                "product": {
                  "name": "mtr/mtr-rhel8-operator@sha256:12e80abe7c02cfbd1a179cb304bef58b72729f5821113c98e2230dda517ef4ec_ppc64le",
                  "product_id": "mtr/mtr-rhel8-operator@sha256:12e80abe7c02cfbd1a179cb304bef58b72729f5821113c98e2230dda517ef4ec_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtr-rhel8-operator@sha256:12e80abe7c02cfbd1a179cb304bef58b72729f5821113c98e2230dda517ef4ec?arch=ppc64le\u0026repository_url=registry.redhat.io/mtr/mtr-rhel8-operator\u0026tag=1.1-7"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mtr/mtr-web-container-rhel8@sha256:74c5ddfc32d28a9f7a08364910413ffcae2453faaded21befcf28840414c968b_ppc64le",
                "product": {
                  "name": "mtr/mtr-web-container-rhel8@sha256:74c5ddfc32d28a9f7a08364910413ffcae2453faaded21befcf28840414c968b_ppc64le",
                  "product_id": "mtr/mtr-web-container-rhel8@sha256:74c5ddfc32d28a9f7a08364910413ffcae2453faaded21befcf28840414c968b_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtr-web-container-rhel8@sha256:74c5ddfc32d28a9f7a08364910413ffcae2453faaded21befcf28840414c968b?arch=ppc64le\u0026repository_url=registry.redhat.io/mtr/mtr-web-container-rhel8\u0026tag=1.1-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mtr/mtr-web-executor-container-rhel8@sha256:5c27fad928e344f4b26b6fb68b3c21adfe695ee1707063d959fa722d72d7eef1_ppc64le",
                "product": {
                  "name": "mtr/mtr-web-executor-container-rhel8@sha256:5c27fad928e344f4b26b6fb68b3c21adfe695ee1707063d959fa722d72d7eef1_ppc64le",
                  "product_id": "mtr/mtr-web-executor-container-rhel8@sha256:5c27fad928e344f4b26b6fb68b3c21adfe695ee1707063d959fa722d72d7eef1_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtr-web-executor-container-rhel8@sha256:5c27fad928e344f4b26b6fb68b3c21adfe695ee1707063d959fa722d72d7eef1?arch=ppc64le\u0026repository_url=registry.redhat.io/mtr/mtr-web-executor-container-rhel8\u0026tag=1.1-7"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mtr/mtr-operator-bundle@sha256:8b608899c571a4729a241f041bfaa65c183c9e81dc1731e650f0db84c24fc274_s390x",
                "product": {
                  "name": "mtr/mtr-operator-bundle@sha256:8b608899c571a4729a241f041bfaa65c183c9e81dc1731e650f0db84c24fc274_s390x",
                  "product_id": "mtr/mtr-operator-bundle@sha256:8b608899c571a4729a241f041bfaa65c183c9e81dc1731e650f0db84c24fc274_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtr-operator-bundle@sha256:8b608899c571a4729a241f041bfaa65c183c9e81dc1731e650f0db84c24fc274?arch=s390x\u0026repository_url=registry.redhat.io/mtr/mtr-operator-bundle\u0026tag=1.1-9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mtr/mtr-rhel8-operator@sha256:f9b5c11144415597762706d93d1f90b2b684dbcab4dd5b83204831d0a3bf529f_s390x",
                "product": {
                  "name": "mtr/mtr-rhel8-operator@sha256:f9b5c11144415597762706d93d1f90b2b684dbcab4dd5b83204831d0a3bf529f_s390x",
                  "product_id": "mtr/mtr-rhel8-operator@sha256:f9b5c11144415597762706d93d1f90b2b684dbcab4dd5b83204831d0a3bf529f_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtr-rhel8-operator@sha256:f9b5c11144415597762706d93d1f90b2b684dbcab4dd5b83204831d0a3bf529f?arch=s390x\u0026repository_url=registry.redhat.io/mtr/mtr-rhel8-operator\u0026tag=1.1-7"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mtr/mtr-web-container-rhel8@sha256:fd35bbd776cd186298a621f8122cdaa059dfa0d480eae08127e963faa5e26680_s390x",
                "product": {
                  "name": "mtr/mtr-web-container-rhel8@sha256:fd35bbd776cd186298a621f8122cdaa059dfa0d480eae08127e963faa5e26680_s390x",
                  "product_id": "mtr/mtr-web-container-rhel8@sha256:fd35bbd776cd186298a621f8122cdaa059dfa0d480eae08127e963faa5e26680_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtr-web-container-rhel8@sha256:fd35bbd776cd186298a621f8122cdaa059dfa0d480eae08127e963faa5e26680?arch=s390x\u0026repository_url=registry.redhat.io/mtr/mtr-web-container-rhel8\u0026tag=1.1-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mtr/mtr-web-executor-container-rhel8@sha256:42ff12e2c4d6308a6a5d7cb262c7b20e6c2df43542249edc327a35ecccbf21e4_s390x",
                "product": {
                  "name": "mtr/mtr-web-executor-container-rhel8@sha256:42ff12e2c4d6308a6a5d7cb262c7b20e6c2df43542249edc327a35ecccbf21e4_s390x",
                  "product_id": "mtr/mtr-web-executor-container-rhel8@sha256:42ff12e2c4d6308a6a5d7cb262c7b20e6c2df43542249edc327a35ecccbf21e4_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtr-web-executor-container-rhel8@sha256:42ff12e2c4d6308a6a5d7cb262c7b20e6c2df43542249edc327a35ecccbf21e4?arch=s390x\u0026repository_url=registry.redhat.io/mtr/mtr-web-executor-container-rhel8\u0026tag=1.1-7"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mtr/mtr-operator-bundle@sha256:6e4522f5ec12c49e5aad88536accb10eef503e1cabc1abad07ae7a746c03c676_arm64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8",
          "product_id": "8Base-MTR-1:mtr/mtr-operator-bundle@sha256:6e4522f5ec12c49e5aad88536accb10eef503e1cabc1abad07ae7a746c03c676_arm64"
        },
        "product_reference": "mtr/mtr-operator-bundle@sha256:6e4522f5ec12c49e5aad88536accb10eef503e1cabc1abad07ae7a746c03c676_arm64",
        "relates_to_product_reference": "8Base-MTR-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mtr/mtr-operator-bundle@sha256:70c1c24245ce7975c50055f0a9f616cd9db4a6325c9aadc42e80a7618b7a74dd_ppc64le as a component of Migration Toolkit for Runtimes 1 on RHEL 8",
          "product_id": "8Base-MTR-1:mtr/mtr-operator-bundle@sha256:70c1c24245ce7975c50055f0a9f616cd9db4a6325c9aadc42e80a7618b7a74dd_ppc64le"
        },
        "product_reference": "mtr/mtr-operator-bundle@sha256:70c1c24245ce7975c50055f0a9f616cd9db4a6325c9aadc42e80a7618b7a74dd_ppc64le",
        "relates_to_product_reference": "8Base-MTR-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mtr/mtr-operator-bundle@sha256:8b608899c571a4729a241f041bfaa65c183c9e81dc1731e650f0db84c24fc274_s390x as a component of Migration Toolkit for Runtimes 1 on RHEL 8",
          "product_id": "8Base-MTR-1:mtr/mtr-operator-bundle@sha256:8b608899c571a4729a241f041bfaa65c183c9e81dc1731e650f0db84c24fc274_s390x"
        },
        "product_reference": "mtr/mtr-operator-bundle@sha256:8b608899c571a4729a241f041bfaa65c183c9e81dc1731e650f0db84c24fc274_s390x",
        "relates_to_product_reference": "8Base-MTR-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mtr/mtr-operator-bundle@sha256:e43184e29882918430c515933e4669185cb49764bed4ef5da7ce2580f0a79ecd_amd64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8",
          "product_id": "8Base-MTR-1:mtr/mtr-operator-bundle@sha256:e43184e29882918430c515933e4669185cb49764bed4ef5da7ce2580f0a79ecd_amd64"
        },
        "product_reference": "mtr/mtr-operator-bundle@sha256:e43184e29882918430c515933e4669185cb49764bed4ef5da7ce2580f0a79ecd_amd64",
        "relates_to_product_reference": "8Base-MTR-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mtr/mtr-rhel8-operator@sha256:12e80abe7c02cfbd1a179cb304bef58b72729f5821113c98e2230dda517ef4ec_ppc64le as a component of Migration Toolkit for Runtimes 1 on RHEL 8",
          "product_id": "8Base-MTR-1:mtr/mtr-rhel8-operator@sha256:12e80abe7c02cfbd1a179cb304bef58b72729f5821113c98e2230dda517ef4ec_ppc64le"
        },
        "product_reference": "mtr/mtr-rhel8-operator@sha256:12e80abe7c02cfbd1a179cb304bef58b72729f5821113c98e2230dda517ef4ec_ppc64le",
        "relates_to_product_reference": "8Base-MTR-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mtr/mtr-rhel8-operator@sha256:6f2d9ac73482bc381c3f87590954ecb0632ccfe3c50b1f96d9f637d1e60101b3_arm64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8",
          "product_id": "8Base-MTR-1:mtr/mtr-rhel8-operator@sha256:6f2d9ac73482bc381c3f87590954ecb0632ccfe3c50b1f96d9f637d1e60101b3_arm64"
        },
        "product_reference": "mtr/mtr-rhel8-operator@sha256:6f2d9ac73482bc381c3f87590954ecb0632ccfe3c50b1f96d9f637d1e60101b3_arm64",
        "relates_to_product_reference": "8Base-MTR-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mtr/mtr-rhel8-operator@sha256:93db684ab05b08d7a6b55e19e63934b85a758bc0b29b9c49469278ce9f6b456e_amd64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8",
          "product_id": "8Base-MTR-1:mtr/mtr-rhel8-operator@sha256:93db684ab05b08d7a6b55e19e63934b85a758bc0b29b9c49469278ce9f6b456e_amd64"
        },
        "product_reference": "mtr/mtr-rhel8-operator@sha256:93db684ab05b08d7a6b55e19e63934b85a758bc0b29b9c49469278ce9f6b456e_amd64",
        "relates_to_product_reference": "8Base-MTR-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mtr/mtr-rhel8-operator@sha256:f9b5c11144415597762706d93d1f90b2b684dbcab4dd5b83204831d0a3bf529f_s390x as a component of Migration Toolkit for Runtimes 1 on RHEL 8",
          "product_id": "8Base-MTR-1:mtr/mtr-rhel8-operator@sha256:f9b5c11144415597762706d93d1f90b2b684dbcab4dd5b83204831d0a3bf529f_s390x"
        },
        "product_reference": "mtr/mtr-rhel8-operator@sha256:f9b5c11144415597762706d93d1f90b2b684dbcab4dd5b83204831d0a3bf529f_s390x",
        "relates_to_product_reference": "8Base-MTR-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mtr/mtr-web-container-rhel8@sha256:74c5ddfc32d28a9f7a08364910413ffcae2453faaded21befcf28840414c968b_ppc64le as a component of Migration Toolkit for Runtimes 1 on RHEL 8",
          "product_id": "8Base-MTR-1:mtr/mtr-web-container-rhel8@sha256:74c5ddfc32d28a9f7a08364910413ffcae2453faaded21befcf28840414c968b_ppc64le"
        },
        "product_reference": "mtr/mtr-web-container-rhel8@sha256:74c5ddfc32d28a9f7a08364910413ffcae2453faaded21befcf28840414c968b_ppc64le",
        "relates_to_product_reference": "8Base-MTR-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mtr/mtr-web-container-rhel8@sha256:bc3f7a7cda2b40adc2561c3dd7e2193d1da899ad6a499713bf54f4cfa8055f20_amd64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8",
          "product_id": "8Base-MTR-1:mtr/mtr-web-container-rhel8@sha256:bc3f7a7cda2b40adc2561c3dd7e2193d1da899ad6a499713bf54f4cfa8055f20_amd64"
        },
        "product_reference": "mtr/mtr-web-container-rhel8@sha256:bc3f7a7cda2b40adc2561c3dd7e2193d1da899ad6a499713bf54f4cfa8055f20_amd64",
        "relates_to_product_reference": "8Base-MTR-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mtr/mtr-web-container-rhel8@sha256:fd35bbd776cd186298a621f8122cdaa059dfa0d480eae08127e963faa5e26680_s390x as a component of Migration Toolkit for Runtimes 1 on RHEL 8",
          "product_id": "8Base-MTR-1:mtr/mtr-web-container-rhel8@sha256:fd35bbd776cd186298a621f8122cdaa059dfa0d480eae08127e963faa5e26680_s390x"
        },
        "product_reference": "mtr/mtr-web-container-rhel8@sha256:fd35bbd776cd186298a621f8122cdaa059dfa0d480eae08127e963faa5e26680_s390x",
        "relates_to_product_reference": "8Base-MTR-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mtr/mtr-web-executor-container-rhel8@sha256:42ff12e2c4d6308a6a5d7cb262c7b20e6c2df43542249edc327a35ecccbf21e4_s390x as a component of Migration Toolkit for Runtimes 1 on RHEL 8",
          "product_id": "8Base-MTR-1:mtr/mtr-web-executor-container-rhel8@sha256:42ff12e2c4d6308a6a5d7cb262c7b20e6c2df43542249edc327a35ecccbf21e4_s390x"
        },
        "product_reference": "mtr/mtr-web-executor-container-rhel8@sha256:42ff12e2c4d6308a6a5d7cb262c7b20e6c2df43542249edc327a35ecccbf21e4_s390x",
        "relates_to_product_reference": "8Base-MTR-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mtr/mtr-web-executor-container-rhel8@sha256:5c27fad928e344f4b26b6fb68b3c21adfe695ee1707063d959fa722d72d7eef1_ppc64le as a component of Migration Toolkit for Runtimes 1 on RHEL 8",
          "product_id": "8Base-MTR-1:mtr/mtr-web-executor-container-rhel8@sha256:5c27fad928e344f4b26b6fb68b3c21adfe695ee1707063d959fa722d72d7eef1_ppc64le"
        },
        "product_reference": "mtr/mtr-web-executor-container-rhel8@sha256:5c27fad928e344f4b26b6fb68b3c21adfe695ee1707063d959fa722d72d7eef1_ppc64le",
        "relates_to_product_reference": "8Base-MTR-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mtr/mtr-web-executor-container-rhel8@sha256:be070c36939408f3ebe40612e239be07ea495d3a4f838e84db43e2d73dc3987f_amd64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8",
          "product_id": "8Base-MTR-1:mtr/mtr-web-executor-container-rhel8@sha256:be070c36939408f3ebe40612e239be07ea495d3a4f838e84db43e2d73dc3987f_amd64"
        },
        "product_reference": "mtr/mtr-web-executor-container-rhel8@sha256:be070c36939408f3ebe40612e239be07ea495d3a4f838e84db43e2d73dc3987f_amd64",
        "relates_to_product_reference": "8Base-MTR-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mtr/mtr-web-executor-container-rhel8@sha256:dedc08bd847e3dfe8c3789ed17844f15e75edf3a4bf8786f6a7f897f6ca66d7f_arm64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8",
          "product_id": "8Base-MTR-1:mtr/mtr-web-executor-container-rhel8@sha256:dedc08bd847e3dfe8c3789ed17844f15e75edf3a4bf8786f6a7f897f6ca66d7f_arm64"
        },
        "product_reference": "mtr/mtr-web-executor-container-rhel8@sha256:dedc08bd847e3dfe8c3789ed17844f15e75edf3a4bf8786f6a7f897f6ca66d7f_arm64",
        "relates_to_product_reference": "8Base-MTR-1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4492",
      "cwe": {
        "id": "CWE-550",
        "name": "Server-generated Error Message Containing Sensitive Information"
      },
      "discovery_date": "2022-12-14T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-MTR-1:mtr/mtr-operator-bundle@sha256:6e4522f5ec12c49e5aad88536accb10eef503e1cabc1abad07ae7a746c03c676_arm64",
            "8Base-MTR-1:mtr/mtr-operator-bundle@sha256:70c1c24245ce7975c50055f0a9f616cd9db4a6325c9aadc42e80a7618b7a74dd_ppc64le",
            "8Base-MTR-1:mtr/mtr-operator-bundle@sha256:8b608899c571a4729a241f041bfaa65c183c9e81dc1731e650f0db84c24fc274_s390x",
            "8Base-MTR-1:mtr/mtr-operator-bundle@sha256:e43184e29882918430c515933e4669185cb49764bed4ef5da7ce2580f0a79ecd_amd64",
            "8Base-MTR-1:mtr/mtr-rhel8-operator@sha256:12e80abe7c02cfbd1a179cb304bef58b72729f5821113c98e2230dda517ef4ec_ppc64le",
            "8Base-MTR-1:mtr/mtr-rhel8-operator@sha256:6f2d9ac73482bc381c3f87590954ecb0632ccfe3c50b1f96d9f637d1e60101b3_arm64",
            "8Base-MTR-1:mtr/mtr-rhel8-operator@sha256:93db684ab05b08d7a6b55e19e63934b85a758bc0b29b9c49469278ce9f6b456e_amd64",
            "8Base-MTR-1:mtr/mtr-rhel8-operator@sha256:f9b5c11144415597762706d93d1f90b2b684dbcab4dd5b83204831d0a3bf529f_s390x",
            "8Base-MTR-1:mtr/mtr-web-executor-container-rhel8@sha256:42ff12e2c4d6308a6a5d7cb262c7b20e6c2df43542249edc327a35ecccbf21e4_s390x",
            "8Base-MTR-1:mtr/mtr-web-executor-container-rhel8@sha256:5c27fad928e344f4b26b6fb68b3c21adfe695ee1707063d959fa722d72d7eef1_ppc64le",
            "8Base-MTR-1:mtr/mtr-web-executor-container-rhel8@sha256:be070c36939408f3ebe40612e239be07ea495d3a4f838e84db43e2d73dc3987f_amd64",
            "8Base-MTR-1:mtr/mtr-web-executor-container-rhel8@sha256:dedc08bd847e3dfe8c3789ed17844f15e75edf3a4bf8786f6a7f897f6ca66d7f_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2153260"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undertow. The undertow client is not checking the server identity the server certificate presents in HTTPS connections. This is a compulsory step ( that should at least be performed by default) in HTTPS and in http/2.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undertow: Server identity in https connection is not checked by the undertow client",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-MTR-1:mtr/mtr-web-container-rhel8@sha256:74c5ddfc32d28a9f7a08364910413ffcae2453faaded21befcf28840414c968b_ppc64le",
          "8Base-MTR-1:mtr/mtr-web-container-rhel8@sha256:bc3f7a7cda2b40adc2561c3dd7e2193d1da899ad6a499713bf54f4cfa8055f20_amd64",
          "8Base-MTR-1:mtr/mtr-web-container-rhel8@sha256:fd35bbd776cd186298a621f8122cdaa059dfa0d480eae08127e963faa5e26680_s390x"
        ],
        "known_not_affected": [
          "8Base-MTR-1:mtr/mtr-operator-bundle@sha256:6e4522f5ec12c49e5aad88536accb10eef503e1cabc1abad07ae7a746c03c676_arm64",
          "8Base-MTR-1:mtr/mtr-operator-bundle@sha256:70c1c24245ce7975c50055f0a9f616cd9db4a6325c9aadc42e80a7618b7a74dd_ppc64le",
          "8Base-MTR-1:mtr/mtr-operator-bundle@sha256:8b608899c571a4729a241f041bfaa65c183c9e81dc1731e650f0db84c24fc274_s390x",
          "8Base-MTR-1:mtr/mtr-operator-bundle@sha256:e43184e29882918430c515933e4669185cb49764bed4ef5da7ce2580f0a79ecd_amd64",
          "8Base-MTR-1:mtr/mtr-rhel8-operator@sha256:12e80abe7c02cfbd1a179cb304bef58b72729f5821113c98e2230dda517ef4ec_ppc64le",
          "8Base-MTR-1:mtr/mtr-rhel8-operator@sha256:6f2d9ac73482bc381c3f87590954ecb0632ccfe3c50b1f96d9f637d1e60101b3_arm64",
          "8Base-MTR-1:mtr/mtr-rhel8-operator@sha256:93db684ab05b08d7a6b55e19e63934b85a758bc0b29b9c49469278ce9f6b456e_amd64",
          "8Base-MTR-1:mtr/mtr-rhel8-operator@sha256:f9b5c11144415597762706d93d1f90b2b684dbcab4dd5b83204831d0a3bf529f_s390x",
          "8Base-MTR-1:mtr/mtr-web-executor-container-rhel8@sha256:42ff12e2c4d6308a6a5d7cb262c7b20e6c2df43542249edc327a35ecccbf21e4_s390x",
          "8Base-MTR-1:mtr/mtr-web-executor-container-rhel8@sha256:5c27fad928e344f4b26b6fb68b3c21adfe695ee1707063d959fa722d72d7eef1_ppc64le",
          "8Base-MTR-1:mtr/mtr-web-executor-container-rhel8@sha256:be070c36939408f3ebe40612e239be07ea495d3a4f838e84db43e2d73dc3987f_amd64",
          "8Base-MTR-1:mtr/mtr-web-executor-container-rhel8@sha256:dedc08bd847e3dfe8c3789ed17844f15e75edf3a4bf8786f6a7f897f6ca66d7f_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-4492"
        },
        {
          "category": "external",
          "summary": "RHBZ#2153260",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153260"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4492",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-4492"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4492",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4492"
        }
      ],
      "release_date": "2022-12-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-06-27T11:34:44+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-MTR-1:mtr/mtr-web-container-rhel8@sha256:74c5ddfc32d28a9f7a08364910413ffcae2453faaded21befcf28840414c968b_ppc64le",
            "8Base-MTR-1:mtr/mtr-web-container-rhel8@sha256:bc3f7a7cda2b40adc2561c3dd7e2193d1da899ad6a499713bf54f4cfa8055f20_amd64",
            "8Base-MTR-1:mtr/mtr-web-container-rhel8@sha256:fd35bbd776cd186298a621f8122cdaa059dfa0d480eae08127e963faa5e26680_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:3813"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-MTR-1:mtr/mtr-web-container-rhel8@sha256:74c5ddfc32d28a9f7a08364910413ffcae2453faaded21befcf28840414c968b_ppc64le",
            "8Base-MTR-1:mtr/mtr-web-container-rhel8@sha256:bc3f7a7cda2b40adc2561c3dd7e2193d1da899ad6a499713bf54f4cfa8055f20_amd64",
            "8Base-MTR-1:mtr/mtr-web-container-rhel8@sha256:fd35bbd776cd186298a621f8122cdaa059dfa0d480eae08127e963faa5e26680_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undertow: Server identity in https connection is not checked by the undertow client"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.