{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Cost Management Metrics Operator version 3.3.2 release.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift. The operator runs on the latest supported versions of Openshift. This operator obtains OpenShift usage data by querying Prometheus every hour to create metric reports that it uploads to Cost Management at console.redhat.com.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:10895",
        "url": "https://access.redhat.com/errata/RHSA-2024:10895"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification",
        "url": "https://access.redhat.com/security/updates/classification"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-34155",
        "url": "https://access.redhat.com/security/cve/CVE-2024-34155"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/cost_management_service/1-latest/html/getting_started_with_cost_management/steps-to-cost-management",
        "url": "https://docs.redhat.com/en/documentation/cost_management_service/1-latest/html/getting_started_with_cost_management/steps-to-cost-management"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10895.json"
      }
    ],
    "title": "Red Hat Security Advisory: Cost Management Metrics Operator Update",
    "tracking": {
      "current_release_date": "2025-11-28T12:47:12+00:00",
      "generator": {
        "date": "2025-11-28T12:47:12+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.13"
        }
      },
      "id": "RHSA-2024:10895",
      "initial_release_date": "2024-12-09T19:09:42+00:00",
      "revision_history": [
        {
          "date": "2024-12-09T19:09:42+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-03-25T20:51:39+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-28T12:47:12+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Cost Management Metrics Operator 3.3.2",
                "product": {
                  "name": "Cost Management Metrics Operator 3.3.2",
                  "product_id": "Cost Management Metrics Operator 3.3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:cost_management:3.3::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Cost Management Metrics Operator"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64",
                "product": {
                  "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64",
                  "product_id": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/costmanagement-metrics-rhel9-operator@sha256%3A85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c?arch=amd64\u0026repository_url=registry.redhat.io/costmanagement"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64",
                "product": {
                  "name": "registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64",
                  "product_id": "registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/costmanagement-metrics-operator-bundle@sha256%3A448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945?arch=amd64\u0026repository_url=registry.redhat.io/costmanagement"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64",
                "product": {
                  "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64",
                  "product_id": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/costmanagement-metrics-rhel9-operator@sha256%3A6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40?arch=arm64\u0026repository_url=registry.redhat.io/costmanagement"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x",
                "product": {
                  "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x",
                  "product_id": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/costmanagement-metrics-rhel9-operator@sha256%3Af02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4?arch=s390x\u0026repository_url=registry.redhat.io/costmanagement"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le",
                "product": {
                  "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le",
                  "product_id": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/costmanagement-metrics-rhel9-operator@sha256%3A1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3?arch=ppc64le\u0026repository_url=registry.redhat.io/costmanagement"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64 as a component of Cost Management Metrics Operator 3.3.2",
          "product_id": "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64"
        },
        "product_reference": "registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64",
        "relates_to_product_reference": "Cost Management Metrics Operator 3.3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le as a component of Cost Management Metrics Operator 3.3.2",
          "product_id": "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le"
        },
        "product_reference": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le",
        "relates_to_product_reference": "Cost Management Metrics Operator 3.3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64 as a component of Cost Management Metrics Operator 3.3.2",
          "product_id": "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64"
        },
        "product_reference": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64",
        "relates_to_product_reference": "Cost Management Metrics Operator 3.3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64 as a component of Cost Management Metrics Operator 3.3.2",
          "product_id": "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64"
        },
        "product_reference": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64",
        "relates_to_product_reference": "Cost Management Metrics Operator 3.3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x as a component of Cost Management Metrics Operator 3.3.2",
          "product_id": "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x"
        },
        "product_reference": "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x",
        "relates_to_product_reference": "Cost Management Metrics Operator 3.3.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-34155",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "discovery_date": "2024-09-06T21:20:06.929766+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2310527"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the go/parser package of the Golang standard library. Calling any Parse functions on Go source code containing deeply nested literals can cause a panic due to stack exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-674: Uncontrolled Recursion vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nInput validation controls ensure that inputs triggering recursion are validated to stay within safe limits which reduces the risk of infinite or excessive recursion. The implementation of least functionality on the platform further restricts potential impacts of recursions by disabling unnecessary recursive functions or features, thus reducing the available pathways for a would-be attacker. The inclusion of developer testing and evaluation ensures that recursive functions are tested and that safeguards like error handling are in place. In the case of successful exploitation, detection and containment controls are in place to limit impacts by alerting on anomalous system behavior in real time while process isolation can limit impacts to a single process.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le",
          "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64",
          "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64",
          "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x"
        ],
        "known_not_affected": [
          "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-34155"
        },
        {
          "category": "external",
          "summary": "RHBZ#2310527",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310527"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-34155",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-34155"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-34155",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34155"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/611238",
          "url": "https://go.dev/cl/611238"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/69138",
          "url": "https://go.dev/issue/69138"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk",
          "url": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-3105",
          "url": "https://pkg.go.dev/vuln/GO-2024-3105"
        }
      ],
      "release_date": "2024-09-06T21:15:11.947000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-12-09T19:09:42+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://docs.openshift.com/container-platform/latest/operators/admin/olm- upgrading-operators.html",
          "product_ids": [
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:10895"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:448e65667b5c167699778b0056a18b31dc7ed95022c803217a2786d27d21e945_amd64",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1598a43c0733ca86a857124fd30c104180db6086419a903daac0711559948cd3_ppc64le",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:6a21d8db8b1b4d1cbb3ab9ab8186d8af36e883bdd9b8da27b91907d623f57a40_arm64",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:85edd059d6196a5b0602f1c1b733d502fe44858ccb35f4cfd8bdf02b66a6ed3c_amd64",
            "Cost Management Metrics Operator 3.3.2:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:f02cd3562cf7ea8011a6d40ec8563f34f2ec05c66574edff2fdc876919898ad4_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion"
    }
  ]
}