RHSA-2026:19410
Vulnerability from csaf_redhat - Published: 2026-05-19 23:07 - Updated: 2026-05-22 08:36Summary
Red Hat Security Advisory: MTV RHEL9 Images
Severity
Important
Notes
Topic: Updated Release packages that fix several bugs and add various enhancements are now available.
Details: Migration Toolkit for Virtualization Images
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jsrsasign. A remote attacker could exploit this vulnerability by providing specially crafted zero or negative inputs to the bnModInverse function within the BigInteger.modInverse implementation. This could lead to an infinite loop, causing a permanent denial of service (DoS) by hanging the process.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. An attacker can exploit an incomplete comparison vulnerability in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. By manipulating incorrect comparison checks, an attacker can bias the Digital Signature Algorithm (DSA) nonces during signature generation. This allows the attacker to recover the private key, leading to a critical security compromise.
9.1 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. An attacker can exploit improper verification of cryptographic signatures by supplying malicious domain parameters during the Digital Signature Algorithm (DSA) validation process. This allows the attacker to forge DSA signatures or X.509 certificates, which would then be accepted as legitimate, potentially leading to unauthorized access or data manipulation.
8.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. An attacker can exploit a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process, specifically within the KJUR.crypto.DSA.signWithMessageHash function. By manipulating the signature generation to force specific values, the library emits an invalid signature without retrying. This vulnerability allows an attacker to recover the private key used for signing.
8.7 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. A remote attacker can exploit an incorrect conversion between numeric types by providing a negative exponent to the `modPow` function. This vulnerability can force the computation of incorrect modular inverses, which ultimately allows an attacker to bypass signature verification.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by providing specially crafted input that generates a regular expression with multiple sequential optional groups. This leads to an exponential growth in the generated regular expression, causing a Denial of Service (DoS) due to excessive resource consumption.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64 | — |
Workaround
|
|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64 | — |
Vendor Fix
fix
|
Known not affected
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64 | — | ||
| Unresolved product id: Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64 | — |
Threats
Impact
Important
References
71 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated Release packages that fix several bugs and add various enhancements are now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Migration Toolkit for Virtualization Images",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:19410",
"url": "https://access.redhat.com/errata/RHSA-2026:19410"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29063",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4598",
"url": "https://access.redhat.com/security/cve/CVE-2026-4598"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4599",
"url": "https://access.redhat.com/security/cve/CVE-2026-4599"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4600",
"url": "https://access.redhat.com/security/cve/CVE-2026-4600"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4601",
"url": "https://access.redhat.com/security/cve/CVE-2026-4601"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4602",
"url": "https://access.redhat.com/security/cve/CVE-2026-4602"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4800",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4926",
"url": "https://access.redhat.com/security/cve/CVE-2026-4926"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization",
"url": "https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19410.json"
}
],
"title": "Red Hat Security Advisory: MTV RHEL9 Images",
"tracking": {
"current_release_date": "2026-05-22T08:36:21+00:00",
"generator": {
"date": "2026-05-22T08:36:21+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.1"
}
},
"id": "RHSA-2026:19410",
"initial_release_date": "2026-05-19T23:07:07+00:00",
"revision_history": [
{
"date": "2026-05-19T23:07:07+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-05-19T23:07:41+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-22T08:36:21+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Migration Toolkit for Virtualization 2.9",
"product": {
"name": "Migration Toolkit for Virtualization 2.9",
"product_id": "Migration Toolkit for Virtualization 2.9",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:migration_toolkit_virtualization:2.9::el9"
}
}
}
],
"category": "product_family",
"name": "Migration Toolkit for Virtualization"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-api-rhel9@sha256%3A0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779084876"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-console-plugin-rhel9@sha256%3Aac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1778927462"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-controller-rhel9@sha256%3A6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779086718"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-must-gather-rhel9@sha256%3Ad6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779132842"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-rhel9-operator@sha256%3A43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779085935"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-operator-bundle@sha256%3Ac831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779231116"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-openstack-populator-rhel9@sha256%3A4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779086031"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-ova-provider-server-rhel9@sha256%3Ae2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779085127"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-populator-controller-rhel9@sha256%3A1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779086329"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-validation-rhel9@sha256%3A86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779085283"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-virt-v2v-rhel9@sha256%3A8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779085438"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64",
"product": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64",
"product_id": "registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mtv-vsphere-xcopy-volume-populator-rhel9@sha256%3Ae3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization\u0026tag=1779085916"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64 as a component of Migration Toolkit for Virtualization 2.9",
"product_id": "Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64 as a component of Migration Toolkit for Virtualization 2.9",
"product_id": "Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64 as a component of Migration Toolkit for Virtualization 2.9",
"product_id": "Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64 as a component of Migration Toolkit for Virtualization 2.9",
"product_id": "Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64 as a component of Migration Toolkit for Virtualization 2.9",
"product_id": "Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64 as a component of Migration Toolkit for Virtualization 2.9",
"product_id": "Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64 as a component of Migration Toolkit for Virtualization 2.9",
"product_id": "Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64 as a component of Migration Toolkit for Virtualization 2.9",
"product_id": "Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64 as a component of Migration Toolkit for Virtualization 2.9",
"product_id": "Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64 as a component of Migration Toolkit for Virtualization 2.9",
"product_id": "Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64 as a component of Migration Toolkit for Virtualization 2.9",
"product_id": "Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64 as a component of Migration Toolkit for Virtualization 2.9",
"product_id": "Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
},
"product_reference": "registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64",
"relates_to_product_reference": "Migration Toolkit for Virtualization 2.9"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-4598",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-03-23T06:01:47.891452+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450210"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. A remote attacker could exploit this vulnerability by providing specially crafted zero or negative inputs to the bnModInverse function within the BigInteger.modInverse implementation. This could lead to an infinite loop, causing a permanent denial of service (DoS) by hanging the process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Denial of Service via infinite loop in bnModInverse function with crafted inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT: A denial of service flaw was found in jsrsasign. This vulnerability allows a remote attacker to cause a permanent denial of service by providing specially crafted zero or negative inputs to the bnModInverse function, leading to an infinite loop. This affects Red Hat Migration Toolkit for Virtualization and Red Hat Quay, which utilize the vulnerable jsrsasign component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64"
],
"known_not_affected": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4598"
},
{
"category": "external",
"summary": "RHBZ#2450210",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450210"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4598",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4598"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4598",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4598"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264",
"url": "https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323",
"url": "https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/648",
"url": "https://github.com/kjur/jsrsasign/pull/648"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938"
}
],
"release_date": "2026-03-23T05:00:11.571000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T23:07:07+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.9/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:19410"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Denial of Service via infinite loop in bnModInverse function with crafted inputs"
},
{
"cve": "CVE-2026-4599",
"cwe": {
"id": "CWE-338",
"name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"
},
"discovery_date": "2026-03-23T06:01:34.008562+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450207"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit an incomplete comparison vulnerability in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. By manipulating incorrect comparison checks, an attacker can bias the Digital Signature Algorithm (DSA) nonces during signature generation. This allows the attacker to recover the private key, leading to a critical security compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64"
],
"known_not_affected": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4599"
},
{
"category": "external",
"summary": "RHBZ#2450207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4599",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4599"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4599",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4599"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20",
"url": "https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1",
"url": "https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/647",
"url": "https://github.com/kjur/jsrsasign/pull/647"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939"
}
],
"release_date": "2026-03-23T05:00:12.522000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T23:07:07+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.9/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:19410"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces"
},
{
"cve": "CVE-2026-4600",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-23T06:01:39.334925+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450208"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit improper verification of cryptographic signatures by supplying malicious domain parameters during the Digital Signature Algorithm (DSA) validation process. This allows the attacker to forge DSA signatures or X.509 certificates, which would then be accepted as legitimate, potentially leading to unauthorized access or data manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT. The flaw in jsrsasign allows an attacker to forge Digital Signature Algorithm (DSA) signatures or X.509 certificates by providing malicious domain parameters during validation. This could lead to unauthorized access or data manipulation in affected Red Hat products such as Migration Toolkit for Virtualization and Red Hat Quay, where jsrsasign is utilized for cryptographic signature verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64"
],
"known_not_affected": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4600"
},
{
"category": "external",
"summary": "RHBZ#2450208",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450208"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4600"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4600",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4600"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7",
"url": "https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60",
"url": "https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/646",
"url": "https://github.com/kjur/jsrsasign/pull/646"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940"
}
],
"release_date": "2026-03-23T05:00:08.475000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T23:07:07+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.9/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:19410"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters"
},
{
"cve": "CVE-2026-4601",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-03-23T06:01:44.014846+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450209"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process, specifically within the KJUR.crypto.DSA.signWithMessageHash function. By manipulating the signature generation to force specific values, the library emits an invalid signature without retrying. This vulnerability allows an attacker to recover the private key used for signing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT: A flaw in the jsrsasign library allows for private key recovery due to a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process. An attacker can manipulate signature generation within the KJUR.crypto.DSA.signWithMessageHash function to force specific values, enabling the recovery of the private key. This impacts Red Hat products utilizing jsrsasign, such as Migration Toolkit for Virtualization and Red Hat Quay.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64"
],
"known_not_affected": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4601"
},
{
"category": "external",
"summary": "RHBZ#2450209",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450209"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4601"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4601",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4601"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586",
"url": "https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb",
"url": "https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/645",
"url": "https://github.com/kjur/jsrsasign/pull/645"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941"
}
],
"release_date": "2026-03-23T05:00:13.312000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T23:07:07+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.9/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:19410"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing"
},
{
"cve": "CVE-2026-4602",
"cwe": {
"id": "CWE-681",
"name": "Incorrect Conversion between Numeric Types"
},
"discovery_date": "2026-03-23T06:01:28.729668+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450206"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. A remote attacker can exploit an incorrect conversion between numeric types by providing a negative exponent to the `modPow` function. This vulnerability can force the computation of incorrect modular inverses, which ultimately allows an attacker to bypass signature verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an IMPORTANT flaw. The `jsrsasign` library, as used in Red Hat products such as Migration Toolkit for Virtualization and Red Hat Quay, is vulnerable to a signature verification bypass. A remote attacker could provide a specially crafted negative exponent to the `modPow` function, leading to incorrect modular inverse computations and allowing them to bypass signature verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64"
],
"known_not_affected": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4602"
},
{
"category": "external",
"summary": "RHBZ#2450206",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450206"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4602"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4602",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4602"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5",
"url": "https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195",
"url": "https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/650",
"url": "https://github.com/kjur/jsrsasign/pull/650"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175"
}
],
"release_date": "2026-03-23T05:00:10.567000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T23:07:07+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.9/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:19410"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling"
},
{
"cve": "CVE-2026-4800",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-03-31T20:01:21.918257+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453496"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user\u0027s browser. Consequently, the attack surface is strictly restricted to the local browser environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64"
],
"known_not_affected": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "RHBZ#2453496",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
"url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
}
],
"release_date": "2026-03-31T19:25:55.987000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T23:07:07+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.9/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:19410"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
},
{
"cve": "CVE-2026-4926",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-03-26T20:03:28.427630+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451867"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by providing specially crafted input that generates a regular expression with multiple sequential optional groups. This leads to an exponential growth in the generated regular expression, causing a Denial of Service (DoS) due to excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in `path-to-regexp` that can lead to a Denial of Service. The vulnerability occurs when specially crafted input containing multiple sequential optional groups is used to generate regular expressions, causing exponential resource consumption.\n\nThe Red Hat Advanced Cluster Security is not affected by this issue since it\u0027s shipping a `path-to-regexp` version which doesn\u0027t contain the vulnerable code.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64"
],
"known_not_affected": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4926"
},
{
"category": "external",
"summary": "RHBZ#2451867",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451867"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4926",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4926"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4926",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4926"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"release_date": "2026-03-26T18:59:38+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T23:07:07+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.9/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:19410"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, limit the use of multiple sequential optional groups in route patterns within applications that use `path-to-regexp`. Additionally, avoid directly passing user-controlled input as route patterns to prevent the generation of maliciously crafted regular expressions.",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions"
},
{
"cve": "CVE-2026-29063",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-06T19:00:57.982727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445291"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this vulnerability requires that an attacker is able to provide arbitrary data to clients of this library in a way that calls the affected functions with data the attacker controls. In most deployments, the ability to provide data in this fashion requires that an attacker has some degree of privileges to access the affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64"
],
"known_not_affected": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "RHBZ#2445291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
}
],
"release_date": "2026-03-06T18:25:22.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-19T23:07:07+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.9/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv",
"product_ids": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:19410"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64",
"Migration Toolkit for Virtualization 2.9:registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…