RHSA-2026:19409
Vulnerability from csaf_redhat - Published: 2026-05-19 22:52 - Updated: 2026-05-22 08:36Summary
Red Hat Security Advisory: MTV RHEL9 Images
Severity
Important
Notes
Topic: Updated Release packages that fix several bugs and add various enhancements are now available.
Details: Migration Toolkit for Virtualization Images
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jsrsasign. A remote attacker could exploit this vulnerability by providing specially crafted zero or negative inputs to the bnModInverse function within the BigInteger.modInverse implementation. This could lead to an infinite loop, causing a permanent denial of service (DoS) by hanging the process.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. An attacker can exploit an incomplete comparison vulnerability in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. By manipulating incorrect comparison checks, an attacker can bias the Digital Signature Algorithm (DSA) nonces during signature generation. This allows the attacker to recover the private key, leading to a critical security compromise.
9.1 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. An attacker can exploit improper verification of cryptographic signatures by supplying malicious domain parameters during the Digital Signature Algorithm (DSA) validation process. This allows the attacker to forge DSA signatures or X.509 certificates, which would then be accepted as legitimate, potentially leading to unauthorized access or data manipulation.
8.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. An attacker can exploit a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process, specifically within the KJUR.crypto.DSA.signWithMessageHash function. By manipulating the signature generation to force specific values, the library emits an invalid signature without retrying. This vulnerability allows an attacker to recover the private key used for signing.
8.7 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. A remote attacker can exploit an incorrect conversion between numeric types by providing a negative exponent to the `modPow` function. This vulnerability can force the computation of incorrect modular inverses, which ultimately allows an attacker to bypass signature verification.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by providing specially crafted input that generates a regular expression with multiple sequential optional groups. This leads to an exponential growth in the generated regular expression, causing a Denial of Service (DoS) due to excessive resource consumption.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64 | — |
Vendor Fix
fix
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64 | — |
Threats
Impact
Important
References
71 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated Release packages that fix several bugs and add various enhancements are now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Migration Toolkit for Virtualization Images",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:19409",
"url": "https://access.redhat.com/errata/RHSA-2026:19409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29063",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4598",
"url": "https://access.redhat.com/security/cve/CVE-2026-4598"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4599",
"url": "https://access.redhat.com/security/cve/CVE-2026-4599"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4600",
"url": "https://access.redhat.com/security/cve/CVE-2026-4600"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4601",
"url": "https://access.redhat.com/security/cve/CVE-2026-4601"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4602",
"url": "https://access.redhat.com/security/cve/CVE-2026-4602"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4800",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4926",
"url": "https://access.redhat.com/security/cve/CVE-2026-4926"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization",
"url": "https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19409.json"
}
],
"title": "Red Hat Security Advisory: MTV RHEL9 Images",
"tracking": {
"current_release_date": "2026-05-22T08:36:21+00:00",
"generator": {
"date": "2026-05-22T08:36:21+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.1"
}
},
"id": "RHSA-2026:19409",
"initial_release_date": "2026-05-19T22:52:16+00:00",
"revision_history": [
{
"date": "2026-05-19T22:52:16+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-05-19T22:52:41+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-22T08:36:21+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Migration Toolkit for Virtualization 2.1",
"product": {
"name": "Migration Toolkit for Virtualization 2.1",
"product_id": "Migration Toolkit for Virtualization 2.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:migration_toolkit_virtualization:2.10::el9"
}
}
}
],
"category": "product_family",
"name": "Migration Toolkit for Virtualization"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-api-rhel9@sha256%3A6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779138735"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-cli-download-rhel9@sha256%3Ad4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779138168"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-console-plugin-rhel9@sha256%3A0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779139872"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-controller-rhel9@sha256%3A52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779138320"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-must-gather-rhel9@sha256%3Af0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779138211"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-rhel9-operator@sha256%3A5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779138649"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-operator-bundle@sha256%3Acfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779143447"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-ova-proxy-rhel9@sha256%3A8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779139918"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-openstack-populator-rhel9@sha256%3Aa301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779139056"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-ova-provider-server-rhel9@sha256%3Ae740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779138199"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-populator-controller-rhel9@sha256%3A948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779138332"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-validation-rhel9@sha256%3Aa764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779138422"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-virt-v2v-rhel9@sha256%3A55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779138382"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-vsphere-xcopy-volume-populator-rhel9@sha256%3Ac9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779138271"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64 as a component of Migration Toolkit for Virtualization 2.1",
"product_id": "Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64 as a component of Migration Toolkit for Virtualization 2.1",
"product_id": "Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64 as a component of Migration Toolkit for Virtualization 2.1",
"product_id": "Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64 as a component of Migration Toolkit for Virtualization 2.1",
"product_id": "Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64 as a component of Migration Toolkit for Virtualization 2.1",
"product_id": "Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64 as a component of Migration Toolkit for Virtualization 2.1",
"product_id": "Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64 as a component of Migration Toolkit for Virtualization 2.1",
"product_id": "Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64 as a component of Migration Toolkit for Virtualization 2.1",
"product_id": "Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64 as a component of Migration Toolkit for Virtualization 2.1",
"product_id": "Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64 as a component of Migration Toolkit for Virtualization 2.1",
"product_id": "Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64 as a component of Migration Toolkit for Virtualization 2.1",
"product_id": "Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64 as a component of Migration Toolkit for Virtualization 2.1",
"product_id": "Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64 as a component of Migration Toolkit for Virtualization 2.1",
"product_id": "Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64 as a component of Migration Toolkit for Virtualization 2.1",
"product_id": "Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-4598",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-03-23T06:01:47.891452+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450210"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. A remote attacker could exploit this vulnerability by providing specially crafted zero or negative inputs to the bnModInverse function within the BigInteger.modInverse implementation. This could lead to an infinite loop, causing a permanent denial of service (DoS) by hanging the process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Denial of Service via infinite loop in bnModInverse function with crafted inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT: A denial of service flaw was found in jsrsasign. This vulnerability allows a remote attacker to cause a permanent denial of service by providing specially crafted zero or negative inputs to the bnModInverse function, leading to an infinite loop. This affects Red Hat Migration Toolkit for Virtualization and Red Hat Quay, which utilize the vulnerable jsrsasign component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64"
],
"known_not_affected": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4598"
},
{
"category": "external",
"summary": "RHBZ#2450210",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450210"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4598",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4598"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4598",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4598"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264",
"url": "https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323",
"url": "https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/648",
"url": "https://github.com/kjur/jsrsasign/pull/648"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938"
}
],
"release_date": "2026-03-23T05:00:11.571000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T22:52:16+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.10/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:19409"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Denial of Service via infinite loop in bnModInverse function with crafted inputs"
},
{
"cve": "CVE-2026-4599",
"cwe": {
"id": "CWE-338",
"name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"
},
"discovery_date": "2026-03-23T06:01:34.008562+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450207"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit an incomplete comparison vulnerability in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. By manipulating incorrect comparison checks, an attacker can bias the Digital Signature Algorithm (DSA) nonces during signature generation. This allows the attacker to recover the private key, leading to a critical security compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64"
],
"known_not_affected": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4599"
},
{
"category": "external",
"summary": "RHBZ#2450207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4599",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4599"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4599",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4599"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20",
"url": "https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1",
"url": "https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/647",
"url": "https://github.com/kjur/jsrsasign/pull/647"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939"
}
],
"release_date": "2026-03-23T05:00:12.522000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T22:52:16+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.10/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:19409"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces"
},
{
"cve": "CVE-2026-4600",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-23T06:01:39.334925+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450208"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit improper verification of cryptographic signatures by supplying malicious domain parameters during the Digital Signature Algorithm (DSA) validation process. This allows the attacker to forge DSA signatures or X.509 certificates, which would then be accepted as legitimate, potentially leading to unauthorized access or data manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT. The flaw in jsrsasign allows an attacker to forge Digital Signature Algorithm (DSA) signatures or X.509 certificates by providing malicious domain parameters during validation. This could lead to unauthorized access or data manipulation in affected Red Hat products such as Migration Toolkit for Virtualization and Red Hat Quay, where jsrsasign is utilized for cryptographic signature verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64"
],
"known_not_affected": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4600"
},
{
"category": "external",
"summary": "RHBZ#2450208",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450208"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4600"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4600",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4600"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7",
"url": "https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60",
"url": "https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/646",
"url": "https://github.com/kjur/jsrsasign/pull/646"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940"
}
],
"release_date": "2026-03-23T05:00:08.475000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T22:52:16+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.10/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:19409"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters"
},
{
"cve": "CVE-2026-4601",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-03-23T06:01:44.014846+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450209"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process, specifically within the KJUR.crypto.DSA.signWithMessageHash function. By manipulating the signature generation to force specific values, the library emits an invalid signature without retrying. This vulnerability allows an attacker to recover the private key used for signing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT: A flaw in the jsrsasign library allows for private key recovery due to a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process. An attacker can manipulate signature generation within the KJUR.crypto.DSA.signWithMessageHash function to force specific values, enabling the recovery of the private key. This impacts Red Hat products utilizing jsrsasign, such as Migration Toolkit for Virtualization and Red Hat Quay.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64"
],
"known_not_affected": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4601"
},
{
"category": "external",
"summary": "RHBZ#2450209",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450209"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4601"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4601",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4601"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586",
"url": "https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb",
"url": "https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/645",
"url": "https://github.com/kjur/jsrsasign/pull/645"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941"
}
],
"release_date": "2026-03-23T05:00:13.312000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T22:52:16+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.10/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:19409"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing"
},
{
"cve": "CVE-2026-4602",
"cwe": {
"id": "CWE-681",
"name": "Incorrect Conversion between Numeric Types"
},
"discovery_date": "2026-03-23T06:01:28.729668+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450206"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. A remote attacker can exploit an incorrect conversion between numeric types by providing a negative exponent to the `modPow` function. This vulnerability can force the computation of incorrect modular inverses, which ultimately allows an attacker to bypass signature verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an IMPORTANT flaw. The `jsrsasign` library, as used in Red Hat products such as Migration Toolkit for Virtualization and Red Hat Quay, is vulnerable to a signature verification bypass. A remote attacker could provide a specially crafted negative exponent to the `modPow` function, leading to incorrect modular inverse computations and allowing them to bypass signature verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64"
],
"known_not_affected": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4602"
},
{
"category": "external",
"summary": "RHBZ#2450206",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450206"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4602"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4602",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4602"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5",
"url": "https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195",
"url": "https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/650",
"url": "https://github.com/kjur/jsrsasign/pull/650"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175"
}
],
"release_date": "2026-03-23T05:00:10.567000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T22:52:16+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.10/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:19409"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling"
},
{
"cve": "CVE-2026-4800",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-03-31T20:01:21.918257+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453496"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user\u0027s browser. Consequently, the attack surface is strictly restricted to the local browser environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64"
],
"known_not_affected": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "RHBZ#2453496",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
"url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
}
],
"release_date": "2026-03-31T19:25:55.987000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T22:52:16+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.10/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:19409"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
},
{
"cve": "CVE-2026-4926",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-03-26T20:03:28.427630+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451867"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by providing specially crafted input that generates a regular expression with multiple sequential optional groups. This leads to an exponential growth in the generated regular expression, causing a Denial of Service (DoS) due to excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in `path-to-regexp` that can lead to a Denial of Service. The vulnerability occurs when specially crafted input containing multiple sequential optional groups is used to generate regular expressions, causing exponential resource consumption.\n\nThe Red Hat Advanced Cluster Security is not affected by this issue since it\u0027s shipping a `path-to-regexp` version which doesn\u0027t contain the vulnerable code.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64"
],
"known_not_affected": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4926"
},
{
"category": "external",
"summary": "RHBZ#2451867",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451867"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4926",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4926"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4926",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4926"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"release_date": "2026-03-26T18:59:38+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T22:52:16+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.10/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:19409"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, limit the use of multiple sequential optional groups in route patterns within applications that use `path-to-regexp`. Additionally, avoid directly passing user-controlled input as route patterns to prevent the generation of maliciously crafted regular expressions.",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions"
},
{
"cve": "CVE-2026-29063",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-06T19:00:57.982727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445291"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this vulnerability requires that an attacker is able to provide arbitrary data to clients of this library in a way that calls the affected functions with data the attacker controls. In most deployments, the ability to provide data in this fashion requires that an attacker has some degree of privileges to access the affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64"
],
"known_not_affected": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "RHBZ#2445291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
}
],
"release_date": "2026-03-06T18:25:22.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T22:52:16+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.10/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv",
"product_ids": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:19409"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64",
"Migration Toolkit for Virtualization 2.1:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…