RHSA-2026:22800
Vulnerability from csaf_redhat - Published: 2026-06-03 12:10 - Updated: 2026-06-29 17:50Summary
Red Hat Security Advisory: OpenShift Container Platform 4.21 CNF vRAN extras topology aware lifecycle manager update
Severity
Important
Notes
Topic: An update for topology-aware-lifecycle manager is available for Red Hat OpenShift Container Platform 4.21.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the extra vran topology aware lifecycle manager images for Red Hat OpenShift Container Platform 4.21.
All OpenShift Container Platform users are advised to upgrade to these updated packages and images.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-rhel9-operator@sha256:9aee6301248bbbfba3858f4d16bc5084c59c299926f35df58a1c97658b828e44_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-aztp-rhel9@sha256:3c360ca44835a7af1ef1ea4cbe803b5730bcadddfed2784b2d898efc10dc5c08_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:9698159364350db7753c317c098ec008d73ab26796a7c400153b1a97607bc8c1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-precache-rhel9@sha256:ca8caf9b82221f9e1229934f55f26ed65636cba7d732f3c5b66a1c7ebedb5b3f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-recovery-rhel9@sha256:434fc75ae6d93dbffaca9aec0939e0540dc5ed9fd13c5a6c7ec979196708eb16_amd64 | — |
Workaround
|
Threats
Impact
Important
References
9 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for topology-aware-lifecycle manager is available for Red Hat OpenShift Container Platform 4.21.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.\nThis advisory contains the extra vran topology aware lifecycle manager images for Red Hat OpenShift Container Platform 4.21.\nAll OpenShift Container Platform users are advised to upgrade to these updated packages and images.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:22800",
"url": "https://access.redhat.com/errata/RHSA-2026:22800"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22800.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.21 CNF vRAN extras topology aware lifecycle manager update",
"tracking": {
"current_release_date": "2026-06-29T17:50:37+00:00",
"generator": {
"date": "2026-06-29T17:50:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.2.6"
}
},
"id": "RHSA-2026:22800",
"initial_release_date": "2026-06-03T12:10:29+00:00",
"revision_history": [
{
"date": "2026-06-03T12:10:29+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-03T12:10:53+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-29T17:50:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.21",
"product": {
"name": "Red Hat OpenShift Container Platform 4.21",
"product_id": "Red Hat OpenShift Container Platform 4.21",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.21::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Container Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-rhel9-operator@sha256:9aee6301248bbbfba3858f4d16bc5084c59c299926f35df58a1c97658b828e44_amd64",
"product": {
"name": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-rhel9-operator@sha256:9aee6301248bbbfba3858f4d16bc5084c59c299926f35df58a1c97658b828e44_amd64",
"product_id": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-rhel9-operator@sha256:9aee6301248bbbfba3858f4d16bc5084c59c299926f35df58a1c97658b828e44_amd64",
"product_identification_helper": {
"purl": "pkg:oci/topology-aware-lifecycle-manager-rhel9-operator@sha256%3A9aee6301248bbbfba3858f4d16bc5084c59c299926f35df58a1c97658b828e44?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/topology-aware-lifecycle-manager-rhel9-operator\u0026tag=1780126533"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-aztp-rhel9@sha256:3c360ca44835a7af1ef1ea4cbe803b5730bcadddfed2784b2d898efc10dc5c08_amd64",
"product": {
"name": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-aztp-rhel9@sha256:3c360ca44835a7af1ef1ea4cbe803b5730bcadddfed2784b2d898efc10dc5c08_amd64",
"product_id": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-aztp-rhel9@sha256:3c360ca44835a7af1ef1ea4cbe803b5730bcadddfed2784b2d898efc10dc5c08_amd64",
"product_identification_helper": {
"purl": "pkg:oci/topology-aware-lifecycle-manager-aztp-rhel9@sha256%3A3c360ca44835a7af1ef1ea4cbe803b5730bcadddfed2784b2d898efc10dc5c08?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/topology-aware-lifecycle-manager-aztp-rhel9\u0026tag=1780126514"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:9698159364350db7753c317c098ec008d73ab26796a7c400153b1a97607bc8c1_amd64",
"product": {
"name": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:9698159364350db7753c317c098ec008d73ab26796a7c400153b1a97607bc8c1_amd64",
"product_id": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:9698159364350db7753c317c098ec008d73ab26796a7c400153b1a97607bc8c1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/topology-aware-lifecycle-manager-operator-bundle@sha256%3A9698159364350db7753c317c098ec008d73ab26796a7c400153b1a97607bc8c1?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/topology-aware-lifecycle-manager-operator-bundle\u0026tag=1780131275"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-precache-rhel9@sha256:ca8caf9b82221f9e1229934f55f26ed65636cba7d732f3c5b66a1c7ebedb5b3f_amd64",
"product": {
"name": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-precache-rhel9@sha256:ca8caf9b82221f9e1229934f55f26ed65636cba7d732f3c5b66a1c7ebedb5b3f_amd64",
"product_id": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-precache-rhel9@sha256:ca8caf9b82221f9e1229934f55f26ed65636cba7d732f3c5b66a1c7ebedb5b3f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/topology-aware-lifecycle-manager-precache-rhel9@sha256%3Aca8caf9b82221f9e1229934f55f26ed65636cba7d732f3c5b66a1c7ebedb5b3f?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/topology-aware-lifecycle-manager-precache-rhel9\u0026tag=1780126476"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-recovery-rhel9@sha256:434fc75ae6d93dbffaca9aec0939e0540dc5ed9fd13c5a6c7ec979196708eb16_amd64",
"product": {
"name": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-recovery-rhel9@sha256:434fc75ae6d93dbffaca9aec0939e0540dc5ed9fd13c5a6c7ec979196708eb16_amd64",
"product_id": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-recovery-rhel9@sha256:434fc75ae6d93dbffaca9aec0939e0540dc5ed9fd13c5a6c7ec979196708eb16_amd64",
"product_identification_helper": {
"purl": "pkg:oci/topology-aware-lifecycle-manager-recovery-rhel9@sha256%3A434fc75ae6d93dbffaca9aec0939e0540dc5ed9fd13c5a6c7ec979196708eb16?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/topology-aware-lifecycle-manager-recovery-rhel9\u0026tag=1780126495"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-aztp-rhel9@sha256:3c360ca44835a7af1ef1ea4cbe803b5730bcadddfed2784b2d898efc10dc5c08_amd64 as a component of Red Hat OpenShift Container Platform 4.21",
"product_id": "Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-aztp-rhel9@sha256:3c360ca44835a7af1ef1ea4cbe803b5730bcadddfed2784b2d898efc10dc5c08_amd64"
},
"product_reference": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-aztp-rhel9@sha256:3c360ca44835a7af1ef1ea4cbe803b5730bcadddfed2784b2d898efc10dc5c08_amd64",
"relates_to_product_reference": "Red Hat OpenShift Container Platform 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:9698159364350db7753c317c098ec008d73ab26796a7c400153b1a97607bc8c1_amd64 as a component of Red Hat OpenShift Container Platform 4.21",
"product_id": "Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:9698159364350db7753c317c098ec008d73ab26796a7c400153b1a97607bc8c1_amd64"
},
"product_reference": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:9698159364350db7753c317c098ec008d73ab26796a7c400153b1a97607bc8c1_amd64",
"relates_to_product_reference": "Red Hat OpenShift Container Platform 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-precache-rhel9@sha256:ca8caf9b82221f9e1229934f55f26ed65636cba7d732f3c5b66a1c7ebedb5b3f_amd64 as a component of Red Hat OpenShift Container Platform 4.21",
"product_id": "Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-precache-rhel9@sha256:ca8caf9b82221f9e1229934f55f26ed65636cba7d732f3c5b66a1c7ebedb5b3f_amd64"
},
"product_reference": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-precache-rhel9@sha256:ca8caf9b82221f9e1229934f55f26ed65636cba7d732f3c5b66a1c7ebedb5b3f_amd64",
"relates_to_product_reference": "Red Hat OpenShift Container Platform 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-recovery-rhel9@sha256:434fc75ae6d93dbffaca9aec0939e0540dc5ed9fd13c5a6c7ec979196708eb16_amd64 as a component of Red Hat OpenShift Container Platform 4.21",
"product_id": "Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-recovery-rhel9@sha256:434fc75ae6d93dbffaca9aec0939e0540dc5ed9fd13c5a6c7ec979196708eb16_amd64"
},
"product_reference": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-recovery-rhel9@sha256:434fc75ae6d93dbffaca9aec0939e0540dc5ed9fd13c5a6c7ec979196708eb16_amd64",
"relates_to_product_reference": "Red Hat OpenShift Container Platform 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-rhel9-operator@sha256:9aee6301248bbbfba3858f4d16bc5084c59c299926f35df58a1c97658b828e44_amd64 as a component of Red Hat OpenShift Container Platform 4.21",
"product_id": "Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-rhel9-operator@sha256:9aee6301248bbbfba3858f4d16bc5084c59c299926f35df58a1c97658b828e44_amd64"
},
"product_reference": "registry.redhat.io/openshift4/topology-aware-lifecycle-manager-rhel9-operator@sha256:9aee6301248bbbfba3858f4d16bc5084c59c299926f35df58a1c97658b828e44_amd64",
"relates_to_product_reference": "Red Hat OpenShift Container Platform 4.21"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-aztp-rhel9@sha256:3c360ca44835a7af1ef1ea4cbe803b5730bcadddfed2784b2d898efc10dc5c08_amd64",
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:9698159364350db7753c317c098ec008d73ab26796a7c400153b1a97607bc8c1_amd64",
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-precache-rhel9@sha256:ca8caf9b82221f9e1229934f55f26ed65636cba7d732f3c5b66a1c7ebedb5b3f_amd64",
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-recovery-rhel9@sha256:434fc75ae6d93dbffaca9aec0939e0540dc5ed9fd13c5a6c7ec979196708eb16_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-rhel9-operator@sha256:9aee6301248bbbfba3858f4d16bc5084c59c299926f35df58a1c97658b828e44_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-aztp-rhel9@sha256:3c360ca44835a7af1ef1ea4cbe803b5730bcadddfed2784b2d898efc10dc5c08_amd64",
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:9698159364350db7753c317c098ec008d73ab26796a7c400153b1a97607bc8c1_amd64",
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-precache-rhel9@sha256:ca8caf9b82221f9e1229934f55f26ed65636cba7d732f3c5b66a1c7ebedb5b3f_amd64",
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-recovery-rhel9@sha256:434fc75ae6d93dbffaca9aec0939e0540dc5ed9fd13c5a6c7ec979196708eb16_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T12:10:29+00:00",
"details": "For OpenShift Container Platform 4.21, see the following documentation for important instructions about upgrading your cluster and applying this asynchronous errata update:\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/index\nInformation about accessing this content is available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli",
"product_ids": [
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-rhel9-operator@sha256:9aee6301248bbbfba3858f4d16bc5084c59c299926f35df58a1c97658b828e44_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22800"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-aztp-rhel9@sha256:3c360ca44835a7af1ef1ea4cbe803b5730bcadddfed2784b2d898efc10dc5c08_amd64",
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:9698159364350db7753c317c098ec008d73ab26796a7c400153b1a97607bc8c1_amd64",
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-precache-rhel9@sha256:ca8caf9b82221f9e1229934f55f26ed65636cba7d732f3c5b66a1c7ebedb5b3f_amd64",
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-recovery-rhel9@sha256:434fc75ae6d93dbffaca9aec0939e0540dc5ed9fd13c5a6c7ec979196708eb16_amd64",
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-rhel9-operator@sha256:9aee6301248bbbfba3858f4d16bc5084c59c299926f35df58a1c97658b828e44_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-aztp-rhel9@sha256:3c360ca44835a7af1ef1ea4cbe803b5730bcadddfed2784b2d898efc10dc5c08_amd64",
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:9698159364350db7753c317c098ec008d73ab26796a7c400153b1a97607bc8c1_amd64",
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-precache-rhel9@sha256:ca8caf9b82221f9e1229934f55f26ed65636cba7d732f3c5b66a1c7ebedb5b3f_amd64",
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-recovery-rhel9@sha256:434fc75ae6d93dbffaca9aec0939e0540dc5ed9fd13c5a6c7ec979196708eb16_amd64",
"Red Hat OpenShift Container Platform 4.21:registry.redhat.io/openshift4/topology-aware-lifecycle-manager-rhel9-operator@sha256:9aee6301248bbbfba3858f4d16bc5084c59c299926f35df58a1c97658b828e44_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…