rhsa-2024_10906
Vulnerability from csaf_redhat
Published
2024-12-10 01:37
Modified
2024-12-18 04:37
Summary
Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.5 security and bug fix update
Notes
Topic
The Migration Toolkit for Containers (MTC) 1.8.5 is now available.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API.
Security Fix(es) from Bugzilla:
* encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)
* body-parser: Denial of Service Vulnerability in body-parser (CVE-2024-45590)
* golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)
* net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)
* webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule (CVE-2024-43788)
* go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)
* go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)
* path-to-regexp: Backtracking regular expressions cause ReDoS (CVE-2024-45296)
* express: Improper Input Handling in Express Redirects (CVE-2024-43796)
* send: Code Execution Vulnerability in Send Library (CVE-2024-43799)
* serve-static: Improper Sanitization in serve-static (CVE-2024-43800)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "The Migration Toolkit for Containers (MTC) 1.8.5 is now available.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API.\n\nSecurity Fix(es) from Bugzilla:\n\n* encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)\n\n* body-parser: Denial of Service Vulnerability in body-parser (CVE-2024-45590)\n\n* golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)\n\n* net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)\n\n* webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule (CVE-2024-43788)\n\n* go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)\n\n* go/build/constraint: golang: Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)\n\n* path-to-regexp: Backtracking regular expressions cause ReDoS (CVE-2024-45296)\n\n* express: Improper Input Handling in Express Redirects (CVE-2024-43796)\n\n* send: Code Execution Vulnerability in Send Library (CVE-2024-43799)\n\n* serve-static: Improper Sanitization in serve-static (CVE-2024-43800)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2024:10906",
"url": "https://access.redhat.com/errata/RHSA-2024:10906"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2292787",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2292787"
},
{
"category": "external",
"summary": "2295310",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295310"
},
{
"category": "external",
"summary": "2308193",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2308193"
},
{
"category": "external",
"summary": "2310527",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310527"
},
{
"category": "external",
"summary": "2310528",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310528"
},
{
"category": "external",
"summary": "2310529",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310529"
},
{
"category": "external",
"summary": "2310908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310908"
},
{
"category": "external",
"summary": "2311152",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311152"
},
{
"category": "external",
"summary": "2311153",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311153"
},
{
"category": "external",
"summary": "2311154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311154"
},
{
"category": "external",
"summary": "2311171",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311171"
},
{
"category": "external",
"summary": "MIG-1458",
"url": "https://issues.redhat.com/browse/MIG-1458"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10906.json"
}
],
"title": "Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.5 security and bug fix update",
"tracking": {
"current_release_date": "2024-12-18T04:37:04+00:00",
"generator": {
"date": "2024-12-18T04:37:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.3"
}
},
"id": "RHSA-2024:10906",
"initial_release_date": "2024-12-10T01:37:19+00:00",
"revision_history": [
{
"date": "2024-12-10T01:37:19+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2024-12-10T01:37:19+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-12-18T04:37:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "8Base-RHMTC-1.8",
"product": {
"name": "8Base-RHMTC-1.8",
"product_id": "8Base-RHMTC-1.8",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhmt:1.8::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Migration Toolkit"
},
{
"branches": [
{
"category": "product_version",
"name": "rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"product": {
"name": "rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"product_id": "rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-controller-rhel8\u0026tag=v1.8.5-11"
}
}
},
{
"category": "product_version",
"name": "rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"product": {
"name": "rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"product_id": "rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8\u0026tag=v1.8.5-8"
}
}
},
{
"category": "product_version",
"name": "rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"product": {
"name": "rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"product_id": "rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8\u0026tag=v1.8.5-8"
}
}
},
{
"category": "product_version",
"name": "rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"product": {
"name": "rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"product_id": "rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8\u0026tag=v1.8.5-9"
}
}
},
{
"category": "product_version",
"name": "rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"product": {
"name": "rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"product_id": "rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8\u0026tag=v1.8.5-6"
}
}
},
{
"category": "product_version",
"name": "rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"product": {
"name": "rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"product_id": "rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-rhel8-operator\u0026tag=v1.8.5-10"
}
}
},
{
"category": "product_version",
"name": "rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"product": {
"name": "rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"product_id": "rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-operator-bundle\u0026tag=v1.8.5-16"
}
}
},
{
"category": "product_version",
"name": "rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"product": {
"name": "rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"product_id": "rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-registry-rhel8\u0026tag=v1.8.5-6"
}
}
},
{
"category": "product_version",
"name": "rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"product": {
"name": "rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"product_id": "rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8\u0026tag=v1.8.5-7"
}
}
},
{
"category": "product_version",
"name": "rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"product": {
"name": "rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"product_id": "rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-ui-rhel8\u0026tag=v1.8.5-7"
}
}
},
{
"category": "product_version",
"name": "rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64",
"product": {
"name": "rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64",
"product_id": "rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b?arch=amd64\u0026repository_url=registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8\u0026tag=v1.8.5-6"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64 as a component of 8Base-RHMTC-1.8",
"product_id": "8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64"
},
"product_reference": "rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"relates_to_product_reference": "8Base-RHMTC-1.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64 as a component of 8Base-RHMTC-1.8",
"product_id": "8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64"
},
"product_reference": "rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"relates_to_product_reference": "8Base-RHMTC-1.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64 as a component of 8Base-RHMTC-1.8",
"product_id": "8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64"
},
"product_reference": "rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"relates_to_product_reference": "8Base-RHMTC-1.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64 as a component of 8Base-RHMTC-1.8",
"product_id": "8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64"
},
"product_reference": "rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"relates_to_product_reference": "8Base-RHMTC-1.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64 as a component of 8Base-RHMTC-1.8",
"product_id": "8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64"
},
"product_reference": "rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"relates_to_product_reference": "8Base-RHMTC-1.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64 as a component of 8Base-RHMTC-1.8",
"product_id": "8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64"
},
"product_reference": "rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"relates_to_product_reference": "8Base-RHMTC-1.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64 as a component of 8Base-RHMTC-1.8",
"product_id": "8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64"
},
"product_reference": "rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"relates_to_product_reference": "8Base-RHMTC-1.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64 as a component of 8Base-RHMTC-1.8",
"product_id": "8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64"
},
"product_reference": "rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"relates_to_product_reference": "8Base-RHMTC-1.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64 as a component of 8Base-RHMTC-1.8",
"product_id": "8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64"
},
"product_reference": "rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"relates_to_product_reference": "8Base-RHMTC-1.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64 as a component of 8Base-RHMTC-1.8",
"product_id": "8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
},
"product_reference": "rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"relates_to_product_reference": "8Base-RHMTC-1.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64 as a component of 8Base-RHMTC-1.8",
"product_id": "8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
},
"product_reference": "rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64",
"relates_to_product_reference": "8Base-RHMTC-1.8"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-24790",
"cwe": {
"id": "CWE-115",
"name": "Misinterpretation of Input"
},
"discovery_date": "2024-06-17T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2292787"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go language standard library net/netip. The method Is*() (IsPrivate(), IsPublic(), etc) doesn\u0027t behave properly when working with IPv6 mapped to IPv4 addresses. The unexpected behavior can lead to integrity and confidentiality issues, specifically when these methods are used to control access to resources or data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This CVE has been marked as moderate as for our products a network-based attack vector is simply impossible when it comes to golang code,apart from that as per CVE flaw analysis reported by golang, this only affects integrity and confidentiality and has no effect on availability, hence CVSS has been marked as such.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
],
"known_not_affected": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-24790"
},
{
"category": "external",
"summary": "RHBZ#2292787",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2292787"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-24790",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24790"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24790",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24790"
}
],
"release_date": "2024-06-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-12-10T01:37:19+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10906"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses"
},
{
"cve": "CVE-2024-24791",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2024-07-02T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2295310"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go. The net/http module mishandles specific server responses from HTTP/1.1 client requests. This issue may render a connection invalid and cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/http: Denial of service due to improper 100-continue handling in net/http",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An attacker would need to control a malicious server and induce a client to connect to it, requiring some amount of preparation outside of the attacker\u0027s control. This reduces the severity score of this flaw to Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
],
"known_not_affected": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-24791"
},
{
"category": "external",
"summary": "RHBZ#2295310",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295310"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-24791",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24791"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24791",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24791"
},
{
"category": "external",
"summary": "https://go.dev/cl/591255",
"url": "https://go.dev/cl/591255"
},
{
"category": "external",
"summary": "https://go.dev/issue/67555",
"url": "https://go.dev/issue/67555"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ",
"url": "https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ"
}
],
"release_date": "2024-07-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-12-10T01:37:19+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10906"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "net/http: Denial of service due to improper 100-continue handling in net/http"
},
{
"cve": "CVE-2024-34155",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2024-09-06T21:20:06.929766+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2310527"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the go/parser package of the Golang standard library. Calling any Parse functions on Go source code containing deeply nested literals can cause a panic due to stack exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
],
"known_not_affected": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-34155"
},
{
"category": "external",
"summary": "RHBZ#2310527",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310527"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-34155",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34155"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-34155",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34155"
},
{
"category": "external",
"summary": "https://go.dev/cl/611238",
"url": "https://go.dev/cl/611238"
},
{
"category": "external",
"summary": "https://go.dev/issue/69138",
"url": "https://go.dev/issue/69138"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk",
"url": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2024-3105",
"url": "https://pkg.go.dev/vuln/GO-2024-3105"
}
],
"release_date": "2024-09-06T21:15:11.947000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-12-10T01:37:19+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10906"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion"
},
{
"cve": "CVE-2024-34156",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2024-09-06T21:20:09.377905+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2310528"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in Go\u0027s `encoding/gob` package is of high severity because it exposes applications to potential Denial of Service (DoS) attacks through stack exhaustion. Since `gob` relies on recursive function calls to decode nested structures, an attacker could exploit this by sending crafted messages with excessively deep nesting, causing the application to panic due to stack overflow. This risk is particularly important in scenarios where untrusted or external input is processed, as it can lead to system unavailability or crashes, undermining the reliability and availability of services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
],
"known_not_affected": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-34156"
},
{
"category": "external",
"summary": "RHBZ#2310528",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310528"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-34156",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34156"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-34156",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34156"
},
{
"category": "external",
"summary": "https://go.dev/cl/611239",
"url": "https://go.dev/cl/611239"
},
{
"category": "external",
"summary": "https://go.dev/issue/69139",
"url": "https://go.dev/issue/69139"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk",
"url": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2024-3106",
"url": "https://pkg.go.dev/vuln/GO-2024-3106"
}
],
"release_date": "2024-09-06T21:15:12.020000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-12-10T01:37:19+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10906"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion"
},
{
"cve": "CVE-2024-34158",
"cwe": {
"id": "CWE-1325",
"name": "Improperly Controlled Sequential Memory Allocation"
},
"discovery_date": "2024-09-06T21:20:12.126400+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2310529"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the go/build/constraint package of the Golang standard library. Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "go/build/constraint: golang: Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
],
"known_not_affected": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-34158"
},
{
"category": "external",
"summary": "RHBZ#2310529",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310529"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-34158",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34158"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-34158",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34158"
},
{
"category": "external",
"summary": "https://go.dev/cl/611240",
"url": "https://go.dev/cl/611240"
},
{
"category": "external",
"summary": "https://go.dev/issue/69141",
"url": "https://go.dev/issue/69141"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk",
"url": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2024-3107",
"url": "https://pkg.go.dev/vuln/GO-2024-3107"
}
],
"release_date": "2024-09-06T21:15:12.083000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-12-10T01:37:19+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10906"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "go/build/constraint: golang: Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion"
},
{
"cve": "CVE-2024-43788",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2024-08-27T17:20:06.890123+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2308193"
}
],
"notes": [
{
"category": "description",
"text": "A DOM Clobbering vulnerability was found in Webpack via `AutoPublicPathRuntimeModule`. DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script through seemingly benign HTML markups in the webpage, for example, through a post or comment, and leverages the gadgets (pieces of JS code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to Cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or ID attributes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The severity of this issue is classified as moderate rather than important due to the specific conditions required for exploitation. DOM Clobbering, while serious, can only be leveraged in environments where an attacker has the ability to inject unsanitized HTML attributes (e.g., `name` or `id`) into a web page. This limits the attack surface to applications that improperly sanitize user input and rely on Webpack-generated files. Furthermore, the exploitation depends on existing vulnerabilities in the sanitization process, rather than the direct execution of arbitrary scripts. As a result, while the issue can lead to XSS, its impact is constrained by the contextual requirement of HTML injection, lowering its overall severity compared to more direct XSS vectors.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
],
"known_not_affected": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-43788"
},
{
"category": "external",
"summary": "RHBZ#2308193",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2308193"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-43788",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43788"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-43788",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43788"
},
{
"category": "external",
"summary": "https://github.com/webpack/webpack/commit/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61",
"url": "https://github.com/webpack/webpack/commit/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61"
},
{
"category": "external",
"summary": "https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986",
"url": "https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986"
},
{
"category": "external",
"summary": "https://research.securitum.com/xss-in-amp4email-dom-clobbering",
"url": "https://research.securitum.com/xss-in-amp4email-dom-clobbering"
},
{
"category": "external",
"summary": "https://scnps.co/papers/sp23_domclob.pdf",
"url": "https://scnps.co/papers/sp23_domclob.pdf"
}
],
"release_date": "2024-08-27T17:15:07.967000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-12-10T01:37:19+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10906"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule"
},
{
"cve": "CVE-2024-43796",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2024-09-10T15:30:28.106254+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2311152"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Express. This vulnerability allows untrusted code execution via passing untrusted user input to response.redirect(), even if the input is sanitized.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "express: Improper Input Handling in Express Redirects",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
],
"known_not_affected": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-43796"
},
{
"category": "external",
"summary": "RHBZ#2311152",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311152"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-43796",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43796"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-43796",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43796"
},
{
"category": "external",
"summary": "https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553",
"url": "https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553"
},
{
"category": "external",
"summary": "https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx",
"url": "https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx"
}
],
"release_date": "2024-09-10T15:15:17.510000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-12-10T01:37:19+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10906"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "express: Improper Input Handling in Express Redirects"
},
{
"cve": "CVE-2024-43799",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2024-09-10T15:30:30.869487+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2311153"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Send library. This vulnerability allows remote code execution via untrusted input passed to the SendStream.redirect() function.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "send: Code Execution Vulnerability in Send Library",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
],
"known_not_affected": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-43799"
},
{
"category": "external",
"summary": "RHBZ#2311153",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311153"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-43799",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43799"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-43799",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43799"
},
{
"category": "external",
"summary": "https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35",
"url": "https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35"
},
{
"category": "external",
"summary": "https://github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfg",
"url": "https://github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfg"
}
],
"release_date": "2024-09-10T15:15:17.727000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-12-10T01:37:19+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10906"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "send: Code Execution Vulnerability in Send Library"
},
{
"cve": "CVE-2024-43800",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2024-09-10T15:30:33.631718+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2311154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in serve-static. This issue may allow the execution of untrusted code via passing sanitized yet untrusted user input to redirect().",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "serve-static: Improper Sanitization in serve-static",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
],
"known_not_affected": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-43800"
},
{
"category": "external",
"summary": "RHBZ#2311154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-43800",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43800"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-43800",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43800"
},
{
"category": "external",
"summary": "https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b",
"url": "https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b"
},
{
"category": "external",
"summary": "https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa",
"url": "https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa"
},
{
"category": "external",
"summary": "https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p",
"url": "https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p"
}
],
"release_date": "2024-09-10T15:15:17.937000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-12-10T01:37:19+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10906"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "serve-static: Improper Sanitization in serve-static"
},
{
"cve": "CVE-2024-45296",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2024-09-09T19:20:18.127723+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2310908"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in path-to-regexp package, where it turns path strings into regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single-threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "path-to-regexp: Backtracking regular expressions cause ReDoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
],
"known_not_affected": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-45296"
},
{
"category": "external",
"summary": "RHBZ#2310908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310908"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-45296",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45296"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45296",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45296"
},
{
"category": "external",
"summary": "https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f",
"url": "https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f"
},
{
"category": "external",
"summary": "https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6",
"url": "https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6"
},
{
"category": "external",
"summary": "https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j",
"url": "https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j"
}
],
"release_date": "2024-09-09T19:15:13.330000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-12-10T01:37:19+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10906"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "path-to-regexp: Backtracking regular expressions cause ReDoS"
},
{
"cve": "CVE-2024-45590",
"cwe": {
"id": "CWE-405",
"name": "Asymmetric Resource Consumption (Amplification)"
},
"discovery_date": "2024-09-10T16:20:29.292154+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2311171"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in body-parser. This vulnerability causes denial of service via a specially crafted payload when the URL encoding is enabled.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "body-parser: Denial of Service Vulnerability in body-parser",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
],
"known_not_affected": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-45590"
},
{
"category": "external",
"summary": "RHBZ#2311171",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311171"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-45590",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45590"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45590",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45590"
},
{
"category": "external",
"summary": "https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce",
"url": "https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce"
},
{
"category": "external",
"summary": "https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7",
"url": "https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7"
}
],
"release_date": "2024-09-10T16:15:21.083000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-12-10T01:37:19+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:10906"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-RHMTC-1.8:rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64",
"8Base-RHMTC-1.8:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "body-parser: Denial of Service Vulnerability in body-parser"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.