{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for grafana is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\n* dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:8678",
        "url": "https://access.redhat.com/errata/RHSA-2024:8678"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "external",
        "summary": "2318052",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318052"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8678.json"
      }
    ],
    "title": "Red Hat Security Advisory: grafana security update",
    "tracking": {
      "current_release_date": "2025-01-06T22:03:36+00:00",
      "generator": {
        "date": "2025-01-06T22:03:36+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.5"
        }
      },
      "id": "RHSA-2024:8678",
      "initial_release_date": "2024-10-30T19:42:46+00:00",
      "revision_history": [
        {
          "date": "2024-10-30T19:42:46+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-30T19:42:46+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-01-06T22:03:36+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.4.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-19.el9_4.src",
                "product": {
                  "name": "grafana-0:9.2.10-19.el9_4.src",
                  "product_id": "grafana-0:9.2.10-19.el9_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-19.el9_4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-19.el9_4.aarch64",
                "product": {
                  "name": "grafana-0:9.2.10-19.el9_4.aarch64",
                  "product_id": "grafana-0:9.2.10-19.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-19.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-19.el9_4.aarch64",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-19.el9_4.aarch64",
                  "product_id": "grafana-selinux-0:9.2.10-19.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-19.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
                  "product_id": "grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-19.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
                  "product_id": "grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-19.el9_4?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-19.el9_4.ppc64le",
                "product": {
                  "name": "grafana-0:9.2.10-19.el9_4.ppc64le",
                  "product_id": "grafana-0:9.2.10-19.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-19.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
                  "product_id": "grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-19.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
                  "product_id": "grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-19.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
                  "product_id": "grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-19.el9_4?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-19.el9_4.x86_64",
                "product": {
                  "name": "grafana-0:9.2.10-19.el9_4.x86_64",
                  "product_id": "grafana-0:9.2.10-19.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-19.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-19.el9_4.x86_64",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-19.el9_4.x86_64",
                  "product_id": "grafana-selinux-0:9.2.10-19.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-19.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
                  "product_id": "grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-19.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
                  "product_id": "grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-19.el9_4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-19.el9_4.s390x",
                "product": {
                  "name": "grafana-0:9.2.10-19.el9_4.s390x",
                  "product_id": "grafana-0:9.2.10-19.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-19.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-19.el9_4.s390x",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-19.el9_4.s390x",
                  "product_id": "grafana-selinux-0:9.2.10-19.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-19.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-19.el9_4.s390x",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-19.el9_4.s390x",
                  "product_id": "grafana-debugsource-0:9.2.10-19.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-19.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
                  "product_id": "grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-19.el9_4?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-19.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64"
        },
        "product_reference": "grafana-0:9.2.10-19.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-19.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le"
        },
        "product_reference": "grafana-0:9.2.10-19.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-19.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x"
        },
        "product_reference": "grafana-0:9.2.10-19.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-19.el9_4.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src"
        },
        "product_reference": "grafana-0:9.2.10-19.el9_4.src",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-19.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64"
        },
        "product_reference": "grafana-0:9.2.10-19.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-19.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-19.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-19.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-19.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-19.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-19.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-19.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-19.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-19.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64"
        },
        "product_reference": "grafana-selinux-0:9.2.10-19.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-19.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le"
        },
        "product_reference": "grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-19.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x"
        },
        "product_reference": "grafana-selinux-0:9.2.10-19.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-19.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
        },
        "product_reference": "grafana-selinux-0:9.2.10-19.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-30T19:42:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8678"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    },
    {
      "cve": "CVE-2024-47875",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2024-10-11T15:20:07.304345+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2318052"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: nesting-based mutation XSS vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "RHBZ#2318052",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318052"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47875",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47875",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098",
          "url": "https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f",
          "url": "https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a",
          "url": "https://github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf"
        }
      ],
      "release_date": "2024-10-11T15:15:05.860000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-30T19:42:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8678"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dompurify: nesting-based mutation XSS vulnerability"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for grafana-pcp is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.\n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:9551",
        "url": "https://access.redhat.com/errata/RHSA-2024:9551"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9551.json"
      }
    ],
    "title": "Red Hat Security Advisory: grafana-pcp security update",
    "tracking": {
      "current_release_date": "2025-01-06T22:02:55+00:00",
      "generator": {
        "date": "2025-01-06T22:02:55+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.5"
        }
      },
      "id": "RHSA-2024:9551",
      "initial_release_date": "2024-11-13T14:54:47+00:00",
      "revision_history": [
        {
          "date": "2024-11-13T14:54:47+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-11-13T14:54:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-01-06T22:02:55+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)",
                  "product_id": "AppStream-9.4.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus:9.4::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-4.el9_4.src",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-4.el9_4.src",
                  "product_id": "grafana-pcp-0:5.1.1-4.el9_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-4.el9_4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-4.el9_4.aarch64",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-4.el9_4.aarch64",
                  "product_id": "grafana-pcp-0:5.1.1-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-4.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-4.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-4.el9_4?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
                  "product_id": "grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-4.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-4.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-4.el9_4?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-4.el9_4.x86_64",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-4.el9_4.x86_64",
                  "product_id": "grafana-pcp-0:5.1.1-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-4.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-4.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-4.el9_4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-4.el9_4.s390x",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-4.el9_4.s390x",
                  "product_id": "grafana-pcp-0:5.1.1-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-4.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-4.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-4.el9_4?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.aarch64"
        },
        "product_reference": "grafana-pcp-0:5.1.1-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.ppc64le"
        },
        "product_reference": "grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.s390x"
        },
        "product_reference": "grafana-pcp-0:5.1.1-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-4.el9_4.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.src"
        },
        "product_reference": "grafana-pcp-0:5.1.1-4.el9_4.src",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.x86_64"
        },
        "product_reference": "grafana-pcp-0:5.1.1-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.s390x",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.src",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.x86_64",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-13T14:54:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.src",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:9551"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.src",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.src",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for grafana is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\n* dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:8327",
        "url": "https://access.redhat.com/errata/RHSA-2024:8327"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "external",
        "summary": "2318052",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318052"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8327.json"
      }
    ],
    "title": "Red Hat Security Advisory: grafana security update",
    "tracking": {
      "current_release_date": "2025-01-06T22:03:26+00:00",
      "generator": {
        "date": "2025-01-06T22:03:26+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.5"
        }
      },
      "id": "RHSA-2024:8327",
      "initial_release_date": "2024-10-22T15:15:27+00:00",
      "revision_history": [
        {
          "date": "2024-10-22T15:15:27+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-22T15:15:27+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-01-06T22:03:26+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-20.el8_10.src",
                "product": {
                  "name": "grafana-0:9.2.10-20.el8_10.src",
                  "product_id": "grafana-0:9.2.10-20.el8_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-20.el8_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-20.el8_10.aarch64",
                "product": {
                  "name": "grafana-0:9.2.10-20.el8_10.aarch64",
                  "product_id": "grafana-0:9.2.10-20.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-20.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-20.el8_10.aarch64",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-20.el8_10.aarch64",
                  "product_id": "grafana-selinux-0:9.2.10-20.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-20.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
                  "product_id": "grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-20.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
                  "product_id": "grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-20.el8_10?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-20.el8_10.ppc64le",
                "product": {
                  "name": "grafana-0:9.2.10-20.el8_10.ppc64le",
                  "product_id": "grafana-0:9.2.10-20.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-20.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
                  "product_id": "grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-20.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
                  "product_id": "grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-20.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
                  "product_id": "grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-20.el8_10?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-20.el8_10.x86_64",
                "product": {
                  "name": "grafana-0:9.2.10-20.el8_10.x86_64",
                  "product_id": "grafana-0:9.2.10-20.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-20.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-20.el8_10.x86_64",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-20.el8_10.x86_64",
                  "product_id": "grafana-selinux-0:9.2.10-20.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-20.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
                  "product_id": "grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-20.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
                  "product_id": "grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-20.el8_10?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-20.el8_10.s390x",
                "product": {
                  "name": "grafana-0:9.2.10-20.el8_10.s390x",
                  "product_id": "grafana-0:9.2.10-20.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-20.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-20.el8_10.s390x",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-20.el8_10.s390x",
                  "product_id": "grafana-selinux-0:9.2.10-20.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-20.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-20.el8_10.s390x",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-20.el8_10.s390x",
                  "product_id": "grafana-debugsource-0:9.2.10-20.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-20.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
                  "product_id": "grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-20.el8_10?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-20.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64"
        },
        "product_reference": "grafana-0:9.2.10-20.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-20.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le"
        },
        "product_reference": "grafana-0:9.2.10-20.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-20.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x"
        },
        "product_reference": "grafana-0:9.2.10-20.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-20.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src"
        },
        "product_reference": "grafana-0:9.2.10-20.el8_10.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-20.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64"
        },
        "product_reference": "grafana-0:9.2.10-20.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-20.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-20.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-20.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-20.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-20.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-20.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-20.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-20.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-20.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64"
        },
        "product_reference": "grafana-selinux-0:9.2.10-20.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-20.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le"
        },
        "product_reference": "grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-20.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x"
        },
        "product_reference": "grafana-selinux-0:9.2.10-20.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-20.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
        },
        "product_reference": "grafana-selinux-0:9.2.10-20.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-22T15:15:27+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8327"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    },
    {
      "cve": "CVE-2024-47875",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2024-10-11T15:20:07.304345+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2318052"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: nesting-based mutation XSS vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "RHBZ#2318052",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318052"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47875",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47875",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098",
          "url": "https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f",
          "url": "https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a",
          "url": "https://github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf"
        }
      ],
      "release_date": "2024-10-11T15:15:05.860000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-22T15:15:27+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8327"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dompurify: nesting-based mutation XSS vulnerability"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for grafana-pcp is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.\n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:8847",
        "url": "https://access.redhat.com/errata/RHSA-2024:8847"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8847.json"
      }
    ],
    "title": "Red Hat Security Advisory: grafana-pcp security update",
    "tracking": {
      "current_release_date": "2025-07-10T01:49:14+00:00",
      "generator": {
        "date": "2025-07-10T01:49:14+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.3"
        }
      },
      "id": "RHSA-2024:8847",
      "initial_release_date": "2024-11-05T03:58:20+00:00",
      "revision_history": [
        {
          "date": "2024-11-05T03:58:20+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-11-05T03:58:20+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-10T01:49:14+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-9.el8_10.src",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-9.el8_10.src",
                  "product_id": "grafana-pcp-0:5.1.1-9.el8_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-9.el8_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-9.el8_10.aarch64",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-9.el8_10.aarch64",
                  "product_id": "grafana-pcp-0:5.1.1-9.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-9.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-9.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-9.el8_10?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
                  "product_id": "grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-9.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-9.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-9.el8_10?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-9.el8_10.x86_64",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-9.el8_10.x86_64",
                  "product_id": "grafana-pcp-0:5.1.1-9.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-9.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-9.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-9.el8_10?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-9.el8_10.s390x",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-9.el8_10.s390x",
                  "product_id": "grafana-pcp-0:5.1.1-9.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-9.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-9.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-9.el8_10?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-9.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.aarch64"
        },
        "product_reference": "grafana-pcp-0:5.1.1-9.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-9.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.ppc64le"
        },
        "product_reference": "grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-9.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.s390x"
        },
        "product_reference": "grafana-pcp-0:5.1.1-9.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-9.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.src"
        },
        "product_reference": "grafana-pcp-0:5.1.1-9.el8_10.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-9.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.x86_64"
        },
        "product_reference": "grafana-pcp-0:5.1.1-9.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-05T03:58:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8847"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for grafana-pcp is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.\n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:9551",
        "url": "https://access.redhat.com/errata/RHSA-2024:9551"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9551.json"
      }
    ],
    "title": "Red Hat Security Advisory: grafana-pcp security update",
    "tracking": {
      "current_release_date": "2025-07-10T01:49:28+00:00",
      "generator": {
        "date": "2025-07-10T01:49:28+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.3"
        }
      },
      "id": "RHSA-2024:9551",
      "initial_release_date": "2024-11-13T14:54:47+00:00",
      "revision_history": [
        {
          "date": "2024-11-13T14:54:47+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-11-13T14:54:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-10T01:49:28+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)",
                  "product_id": "AppStream-9.4.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus:9.4::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-4.el9_4.src",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-4.el9_4.src",
                  "product_id": "grafana-pcp-0:5.1.1-4.el9_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-4.el9_4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-4.el9_4.aarch64",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-4.el9_4.aarch64",
                  "product_id": "grafana-pcp-0:5.1.1-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-4.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-4.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-4.el9_4?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
                  "product_id": "grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-4.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-4.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-4.el9_4?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-4.el9_4.x86_64",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-4.el9_4.x86_64",
                  "product_id": "grafana-pcp-0:5.1.1-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-4.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-4.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-4.el9_4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-4.el9_4.s390x",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-4.el9_4.s390x",
                  "product_id": "grafana-pcp-0:5.1.1-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-4.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-4.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-4.el9_4?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.aarch64"
        },
        "product_reference": "grafana-pcp-0:5.1.1-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.ppc64le"
        },
        "product_reference": "grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.s390x"
        },
        "product_reference": "grafana-pcp-0:5.1.1-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-4.el9_4.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.src"
        },
        "product_reference": "grafana-pcp-0:5.1.1-4.el9_4.src",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.x86_64"
        },
        "product_reference": "grafana-pcp-0:5.1.1-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.s390x",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.src",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.x86_64",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-13T14:54:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.src",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:9551"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.src",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.src",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for rhc-worker-script is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Remote Host Configuration (rhc) worker for executing scripts on hosts managed by Red Hat Insights.\n\nSecurity Fix(es):\n\n* net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:10133",
        "url": "https://access.redhat.com/errata/RHSA-2024:10133"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2295310",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295310"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10133.json"
      }
    ],
    "title": "Red Hat Security Advisory: rhc-worker-script security update",
    "tracking": {
      "current_release_date": "2025-01-06T22:04:25+00:00",
      "generator": {
        "date": "2025-01-06T22:04:25+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.5"
        }
      },
      "id": "RHSA-2024:10133",
      "initial_release_date": "2024-11-21T01:11:03+00:00",
      "revision_history": [
        {
          "date": "2024-11-21T01:11:03+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-11-21T01:11:03+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-01-06T22:04:25+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server (v. 7 ELS)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server (v. 7 ELS)",
                  "product_id": "7Server-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_els:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhc-worker-script-0:0.10-2.el7_9.src",
                "product": {
                  "name": "rhc-worker-script-0:0.10-2.el7_9.src",
                  "product_id": "rhc-worker-script-0:0.10-2.el7_9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhc-worker-script@0.10-2.el7_9?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhc-worker-script-0:0.10-2.el7_9.x86_64",
                "product": {
                  "name": "rhc-worker-script-0:0.10-2.el7_9.x86_64",
                  "product_id": "rhc-worker-script-0:0.10-2.el7_9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhc-worker-script@0.10-2.el7_9?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhc-worker-script-0:0.10-2.el7_9.src as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src"
        },
        "product_reference": "rhc-worker-script-0:0.10-2.el7_9.src",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhc-worker-script-0:0.10-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
        },
        "product_reference": "rhc-worker-script-0:0.10-2.el7_9.x86_64",
        "relates_to_product_reference": "7Server-ELS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
          "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-21T01:11:03+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:10133"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    },
    {
      "cve": "CVE-2024-24791",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2024-07-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2295310"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go. The net/http module mishandles specific server responses from HTTP/1.1 client requests. This issue may render a connection invalid and cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: Denial of service due to improper 100-continue handling in net/http",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An attacker would need to control a malicious server and induce a client to connect to it, requiring some amount of preparation outside of the attacker\u0027s control. This reduces the severity score of this flaw to Moderate.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
          "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "RHBZ#2295310",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295310"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-24791",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24791",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/591255",
          "url": "https://go.dev/cl/591255"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/67555",
          "url": "https://go.dev/issue/67555"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ",
          "url": "https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ"
        }
      ],
      "release_date": "2024-07-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-21T01:11:03+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:10133"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: Denial of service due to improper 100-continue handling in net/http"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Streams for Apache Kafka 2.9.0 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed\nbackbone that allows microservices and other applications to share data with\nextremely high throughput and extremely low latency.\n\nThis release of Red Hat Streams for Apache Kafka 2.9.0 serves as a replacement for Red Hat Streams for Apache Kafka 2.8.0, and includes security and bug fixes, and enhancements.\n\nSecurity Fix(es):\n* Cruise Control:cio.netty:netty-common:4.1.115.Final-redhat [amq-st-2] \"(CVE-2023-52428)\"\n\n* Cruise Control:com.nimbusds:nimbus-jose-jwt:9.37.2.redhat [amq-st-2] \"(CVE-2024-47535)\"\n\n* Cruise Control:org.apache.kafka:kafka-clients:3.5.2.redhat+ [amq-st-2] \"(CVE-2024-31141)\"\n\n* Cruise Control:io:commons-io:2.15.1.redhat+ [amq-st-2] \"(CVE-2024-47554)\"\n\n* Cruise Control:org.eclipse.jetty:jetty-server:9.4.56.v20240826-redhat+ [amq-st-2] \"(CVE-2024-8184)\"\n\n* Cruise Control:org.eclipse.jetty/jetty-server: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks [amq-st-2] \"(CVE-2024-8184)\"\n\n* Kafka Exporter:golang-github-danielqsj-kafka_exporter: Golang FIPS zeroed buffer [amq-st-2] \"(CVE-2024-9355)\"\n\n* Kafka Exporter:golang-github-danielqsj-kafka_exporter: net/http: Denial of service due to improper 100-continue handling in net/http [amq-st-2] \"(CVE-2024-24791)\"",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:2416",
        "url": "https://access.redhat.com/errata/RHSA-2025:2416"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2295310",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295310"
      },
      {
        "category": "external",
        "summary": "2309764",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309764"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "external",
        "summary": "2316271",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316271"
      },
      {
        "category": "external",
        "summary": "2318564",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318564"
      },
      {
        "category": "external",
        "summary": "2325538",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325538"
      },
      {
        "category": "external",
        "summary": "2327264",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2327264"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2416.json"
      }
    ],
    "title": "Red Hat Security Advisory: Streams for Apache Kafka 2.9.0 release and security update",
    "tracking": {
      "current_release_date": "2025-07-17T14:56:55+00:00",
      "generator": {
        "date": "2025-07-17T14:56:55+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.3"
        }
      },
      "id": "RHSA-2025:2416",
      "initial_release_date": "2025-03-05T20:59:06+00:00",
      "revision_history": [
        {
          "date": "2025-03-05T20:59:06+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-03-05T20:59:06+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-17T14:56:55+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Streams for Apache Kafka 2.9.0",
                "product": {
                  "name": "Streams for Apache Kafka 2.9.0",
                  "product_id": "Streams for Apache Kafka 2.9.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:amq_streams:2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Streams for Apache Kafka"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-52428",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-09-04T17:02:58.468000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2309764"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in the Nimbus Jose JWT package. By crafting a JWE with an excessively large p2c value, an attacker can trigger significant resource consumption during decryption, potentially leading to application slowdown or unavailability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nimbus-jose-jwt: large JWE p2c header value causes Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-52428"
        },
        {
          "category": "external",
          "summary": "RHBZ#2309764",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309764"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-52428",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-52428"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-52428",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52428"
        }
      ],
      "release_date": "2024-02-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-03-05T20:59:06+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:2416"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nimbus-jose-jwt: large JWE p2c header value causes Denial of Service"
    },
    {
      "cve": "CVE-2024-8184",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-10-14T16:01:01.239238+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2318564"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Jetty\u0027s ThreadLimitHandler.getRemote(). This flaw allows unauthorized users to cause remote denial of service (DoS) attacks. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server\u0027s memory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.eclipse.jetty:jetty-server: jetty: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as moderate rather than important because it requires specific conditions to be met, including continuous, crafted requests that deliberately target memory allocation to exhaust resources. While it can cause a denial of service, it does not lead to direct compromise of sensitive data, unauthorized access, or code execution.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-400: Uncontrolled Resource Consumption vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nRed Hat restricts access to all platform information by default, granting access only after successful hard token-based multi-factor authentication (MFA) and enforcing least privilege to ensure only authorized roles can execute or modify code. The environment employs malicious code protections, including IDS/IPS and antimalware tools to detect threats and monitor resource usage, helping prevent uncontrolled consumption that could lead to system failure. Additional safeguards, such as web application firewalls and load-balancing strategies, protect against resource exhaustion and performance degradation. Event logs are centrally collected, correlated, and analyzed to support monitoring, alerting, and retention, aiding in the detection of abnormal behavior and potential denial-of-service (DoS) conditions. Static code analysis and peer reviews enforce strong input validation and error handling, reducing the likelihood of input-based DoS attacks.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-8184"
        },
        {
          "category": "external",
          "summary": "RHBZ#2318564",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318564"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-8184",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-8184"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-8184",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8184"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/pull/11723",
          "url": "https://github.com/jetty/jetty.project/pull/11723"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-g8m5-722r-8whq",
          "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-g8m5-722r-8whq"
        },
        {
          "category": "external",
          "summary": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/30",
          "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/30"
        }
      ],
      "release_date": "2024-10-14T15:09:37.861000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-03-05T20:59:06+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:2416"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.eclipse.jetty:jetty-server: jetty: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-03-05T20:59:06+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:2416"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    },
    {
      "cve": "CVE-2024-24791",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2024-07-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2295310"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go. The net/http module mishandles specific server responses from HTTP/1.1 client requests. This issue may render a connection invalid and cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: Denial of service due to improper 100-continue handling in net/http",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An attacker would need to control a malicious server and induce a client to connect to it, requiring some amount of preparation outside of the attacker\u0027s control. This reduces the severity score of this flaw to Moderate.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-20: Improper Input Validation vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nRed Hat enforces the principle of least functionality, ensuring that only essential features, services, and ports are enabled. This minimizes the number of components that could be affected by input validation vulnerabilities. Security testing and evaluation standards are implemented within the environment to rigorously test input validation mechanisms during the development lifecycle, while static code analysis identifies potential input validation vulnerabilities by default. Process isolation ensures that processes handling potentially malicious or unvalidated inputs run in isolated environments by separating execution domains for each process. Malicious code protections, such as IPS/IDS and antimalware solutions, help detect and mitigate malicious payloads stemming from input validation vulnerabilities. Finally, robust input validation and error-handling mechanisms ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks further.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "RHBZ#2295310",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295310"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-24791",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24791",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/591255",
          "url": "https://go.dev/cl/591255"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/67555",
          "url": "https://go.dev/issue/67555"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ",
          "url": "https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ"
        }
      ],
      "release_date": "2024-07-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-03-05T20:59:06+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:2416"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: Denial of service due to improper 100-continue handling in net/http"
    },
    {
      "cve": "CVE-2024-31141",
      "cwe": {
        "id": "CWE-552",
        "name": "Files or Directories Accessible to External Parties"
      },
      "discovery_date": "2024-11-19T09:00:35.857468+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2327264"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Kafka Clients. Apache Kafka Clients accepts configuration data for customizing behavior and includes ConfigProvider plugins to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations, which include the ability to read from disk or environment variables. In applications where an untrusted party can specify Apache Kafka Clients configurations, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-269: Improper Privilege Management or CWE-552: Files or Directories Accessible to External Parties vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nThe platform enforces strict Role-Based Access Control (RBAC), network segmentation, and pod security policies that significantly limit external access pathways. Access to the platform is granted only after successful hard token, multi-factor authentication (MFA), which is coupled with least privilege principles to ensure that only authorized roles and users can execute or manipulate code. Additionally, process isolation ensures that processes running in one container or namespace cannot access files or directories belonging to another, even if file permissions are misconfigured.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-31141"
        },
        {
          "category": "external",
          "summary": "RHBZ#2327264",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2327264"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-31141",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-31141"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-31141",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31141"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv",
          "url": "https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv"
        }
      ],
      "release_date": "2024-11-19T08:40:50.695000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-03-05T20:59:06+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:2416"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider"
    },
    {
      "cve": "CVE-2024-47535",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-11-12T16:01:18.772613+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2325538"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. An unsafe reading of the environment file could potentially cause a denial of service. When loaded on a Windows application, Netty attempts to load a file that does not exist. If an attacker creates a large file, the Netty application crashes.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: Denial of Service attack on windows app using Netty",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-400: Uncontrolled Resource Consumption vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nRed Hat restricts access to all platform information by default, granting access only after successful hard token-based multi-factor authentication (MFA) and enforcing least privilege to ensure only authorized roles can execute or modify code. The environment employs malicious code protections, including IDS/IPS and antimalware tools to detect threats and monitor resource usage, helping prevent uncontrolled consumption that could lead to system failure. Additional safeguards, such as web application firewalls and load-balancing strategies, protect against resource exhaustion and performance degradation. Event logs are centrally collected, correlated, and analyzed to support monitoring, alerting, and retention, aiding in the detection of abnormal behavior and potential denial-of-service (DoS) conditions. Static code analysis and peer reviews enforce strong input validation and error handling, reducing the likelihood of input-based DoS attacks.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47535"
        },
        {
          "category": "external",
          "summary": "RHBZ#2325538",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325538"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47535",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47535"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47535",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47535"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/fbf7a704a82e7449b48bd0bbb679f5661c6d61a3",
          "url": "https://github.com/netty/netty/commit/fbf7a704a82e7449b48bd0bbb679f5661c6d61a3"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv"
        }
      ],
      "release_date": "2024-11-12T15:50:08.334000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-03-05T20:59:06+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:2416"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty: Denial of Service attack on windows app using Netty"
    },
    {
      "cve": "CVE-2024-47554",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-10-03T12:00:40.921058+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2316271"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in the Apache Commons IO component in the org.apache.commons.io.input.XmlStreamReader class. Excessive CPU resource consumption can lead to a denial of service when an untrusted input is processed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-400: Uncontrolled Resource Consumption vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nRed Hat restricts access to all platform information by default, granting access only after successful hard token-based multi-factor authentication (MFA) and enforcing least privilege to ensure only authorized roles can execute or modify code. The environment employs malicious code protections, including IDS/IPS and antimalware tools to detect threats and monitor resource usage, helping prevent uncontrolled consumption that could lead to system failure. Additional safeguards, such as web application firewalls and load-balancing strategies, protect against resource exhaustion and performance degradation. Event logs are centrally collected, correlated, and analyzed to support monitoring, alerting, and retention, aiding in the detection of abnormal behavior and potential denial-of-service (DoS) conditions. Static code analysis and peer reviews enforce strong input validation and error handling, reducing the likelihood of input-based DoS attacks.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47554"
        },
        {
          "category": "external",
          "summary": "RHBZ#2316271",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316271"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47554",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47554"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47554",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47554"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1",
          "url": "https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1"
        }
      ],
      "release_date": "2024-10-03T11:32:48.936000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-03-05T20:59:06+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:2416"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for osbuild and osbuild-composer is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.\n\nSecurity Fix(es):\n\n* golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)\n\n* go/build/constraint: golang: Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:7118",
        "url": "https://access.redhat.com/errata/RHSA-2025:7118"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2262921",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262921"
      },
      {
        "category": "external",
        "summary": "2310529",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310529"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "external",
        "summary": "RHEL-16396",
        "url": "https://issues.redhat.com/browse/RHEL-16396"
      },
      {
        "category": "external",
        "summary": "RHEL-4570",
        "url": "https://issues.redhat.com/browse/RHEL-4570"
      },
      {
        "category": "external",
        "summary": "RHEL-4617",
        "url": "https://issues.redhat.com/browse/RHEL-4617"
      },
      {
        "category": "external",
        "summary": "RHEL-4636",
        "url": "https://issues.redhat.com/browse/RHEL-4636"
      },
      {
        "category": "external",
        "summary": "RHEL-56049",
        "url": "https://issues.redhat.com/browse/RHEL-56049"
      },
      {
        "category": "external",
        "summary": "RHEL-78659",
        "url": "https://issues.redhat.com/browse/RHEL-78659"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7118.json"
      }
    ],
    "title": "Red Hat Security Advisory: osbuild and osbuild-composer security update",
    "tracking": {
      "current_release_date": "2025-07-17T14:57:15+00:00",
      "generator": {
        "date": "2025-07-17T14:57:15+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.3"
        }
      },
      "id": "RHSA-2025:7118",
      "initial_release_date": "2025-05-13T08:41:23+00:00",
      "revision_history": [
        {
          "date": "2025-05-13T08:41:23+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-05-13T08:41:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-17T14:57:15+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.6.0.GA",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "osbuild-composer-0:132-1.el9.src",
                "product": {
                  "name": "osbuild-composer-0:132-1.el9.src",
                  "product_id": "osbuild-composer-0:132-1.el9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer@132-1.el9?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-0:141-1.el9.src",
                "product": {
                  "name": "osbuild-0:141-1.el9.src",
                  "product_id": "osbuild-0:141-1.el9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild@141-1.el9?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "osbuild-composer-0:132-1.el9.aarch64",
                "product": {
                  "name": "osbuild-composer-0:132-1.el9.aarch64",
                  "product_id": "osbuild-composer-0:132-1.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer@132-1.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-0:132-1.el9.aarch64",
                "product": {
                  "name": "osbuild-composer-core-0:132-1.el9.aarch64",
                  "product_id": "osbuild-composer-core-0:132-1.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core@132-1.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-0:132-1.el9.aarch64",
                "product": {
                  "name": "osbuild-composer-worker-0:132-1.el9.aarch64",
                  "product_id": "osbuild-composer-worker-0:132-1.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker@132-1.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debugsource-0:132-1.el9.aarch64",
                "product": {
                  "name": "osbuild-composer-debugsource-0:132-1.el9.aarch64",
                  "product_id": "osbuild-composer-debugsource-0:132-1.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debugsource@132-1.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-debuginfo-0:132-1.el9.aarch64",
                "product": {
                  "name": "osbuild-composer-core-debuginfo-0:132-1.el9.aarch64",
                  "product_id": "osbuild-composer-core-debuginfo-0:132-1.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@132-1.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debuginfo-0:132-1.el9.aarch64",
                "product": {
                  "name": "osbuild-composer-debuginfo-0:132-1.el9.aarch64",
                  "product_id": "osbuild-composer-debuginfo-0:132-1.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@132-1.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64",
                "product": {
                  "name": "osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64",
                  "product_id": "osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@132-1.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64",
                "product": {
                  "name": "osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64",
                  "product_id": "osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@132-1.el9?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "osbuild-composer-0:132-1.el9.ppc64le",
                "product": {
                  "name": "osbuild-composer-0:132-1.el9.ppc64le",
                  "product_id": "osbuild-composer-0:132-1.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer@132-1.el9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-0:132-1.el9.ppc64le",
                "product": {
                  "name": "osbuild-composer-core-0:132-1.el9.ppc64le",
                  "product_id": "osbuild-composer-core-0:132-1.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core@132-1.el9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-0:132-1.el9.ppc64le",
                "product": {
                  "name": "osbuild-composer-worker-0:132-1.el9.ppc64le",
                  "product_id": "osbuild-composer-worker-0:132-1.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker@132-1.el9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debugsource-0:132-1.el9.ppc64le",
                "product": {
                  "name": "osbuild-composer-debugsource-0:132-1.el9.ppc64le",
                  "product_id": "osbuild-composer-debugsource-0:132-1.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debugsource@132-1.el9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le",
                "product": {
                  "name": "osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le",
                  "product_id": "osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@132-1.el9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debuginfo-0:132-1.el9.ppc64le",
                "product": {
                  "name": "osbuild-composer-debuginfo-0:132-1.el9.ppc64le",
                  "product_id": "osbuild-composer-debuginfo-0:132-1.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@132-1.el9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le",
                "product": {
                  "name": "osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le",
                  "product_id": "osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@132-1.el9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le",
                "product": {
                  "name": "osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le",
                  "product_id": "osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@132-1.el9?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "osbuild-composer-0:132-1.el9.x86_64",
                "product": {
                  "name": "osbuild-composer-0:132-1.el9.x86_64",
                  "product_id": "osbuild-composer-0:132-1.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer@132-1.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-0:132-1.el9.x86_64",
                "product": {
                  "name": "osbuild-composer-core-0:132-1.el9.x86_64",
                  "product_id": "osbuild-composer-core-0:132-1.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core@132-1.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-0:132-1.el9.x86_64",
                "product": {
                  "name": "osbuild-composer-worker-0:132-1.el9.x86_64",
                  "product_id": "osbuild-composer-worker-0:132-1.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker@132-1.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debugsource-0:132-1.el9.x86_64",
                "product": {
                  "name": "osbuild-composer-debugsource-0:132-1.el9.x86_64",
                  "product_id": "osbuild-composer-debugsource-0:132-1.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debugsource@132-1.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-debuginfo-0:132-1.el9.x86_64",
                "product": {
                  "name": "osbuild-composer-core-debuginfo-0:132-1.el9.x86_64",
                  "product_id": "osbuild-composer-core-debuginfo-0:132-1.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@132-1.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debuginfo-0:132-1.el9.x86_64",
                "product": {
                  "name": "osbuild-composer-debuginfo-0:132-1.el9.x86_64",
                  "product_id": "osbuild-composer-debuginfo-0:132-1.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@132-1.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64",
                "product": {
                  "name": "osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64",
                  "product_id": "osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@132-1.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64",
                "product": {
                  "name": "osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64",
                  "product_id": "osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@132-1.el9?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "osbuild-composer-0:132-1.el9.s390x",
                "product": {
                  "name": "osbuild-composer-0:132-1.el9.s390x",
                  "product_id": "osbuild-composer-0:132-1.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer@132-1.el9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-0:132-1.el9.s390x",
                "product": {
                  "name": "osbuild-composer-core-0:132-1.el9.s390x",
                  "product_id": "osbuild-composer-core-0:132-1.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core@132-1.el9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-0:132-1.el9.s390x",
                "product": {
                  "name": "osbuild-composer-worker-0:132-1.el9.s390x",
                  "product_id": "osbuild-composer-worker-0:132-1.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker@132-1.el9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debugsource-0:132-1.el9.s390x",
                "product": {
                  "name": "osbuild-composer-debugsource-0:132-1.el9.s390x",
                  "product_id": "osbuild-composer-debugsource-0:132-1.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debugsource@132-1.el9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-debuginfo-0:132-1.el9.s390x",
                "product": {
                  "name": "osbuild-composer-core-debuginfo-0:132-1.el9.s390x",
                  "product_id": "osbuild-composer-core-debuginfo-0:132-1.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@132-1.el9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debuginfo-0:132-1.el9.s390x",
                "product": {
                  "name": "osbuild-composer-debuginfo-0:132-1.el9.s390x",
                  "product_id": "osbuild-composer-debuginfo-0:132-1.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@132-1.el9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-tests-debuginfo-0:132-1.el9.s390x",
                "product": {
                  "name": "osbuild-composer-tests-debuginfo-0:132-1.el9.s390x",
                  "product_id": "osbuild-composer-tests-debuginfo-0:132-1.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@132-1.el9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-debuginfo-0:132-1.el9.s390x",
                "product": {
                  "name": "osbuild-composer-worker-debuginfo-0:132-1.el9.s390x",
                  "product_id": "osbuild-composer-worker-debuginfo-0:132-1.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@132-1.el9?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "osbuild-0:141-1.el9.noarch",
                "product": {
                  "name": "osbuild-0:141-1.el9.noarch",
                  "product_id": "osbuild-0:141-1.el9.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild@141-1.el9?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-depsolve-dnf-0:141-1.el9.noarch",
                "product": {
                  "name": "osbuild-depsolve-dnf-0:141-1.el9.noarch",
                  "product_id": "osbuild-depsolve-dnf-0:141-1.el9.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-depsolve-dnf@141-1.el9?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-luks2-0:141-1.el9.noarch",
                "product": {
                  "name": "osbuild-luks2-0:141-1.el9.noarch",
                  "product_id": "osbuild-luks2-0:141-1.el9.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-luks2@141-1.el9?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-lvm2-0:141-1.el9.noarch",
                "product": {
                  "name": "osbuild-lvm2-0:141-1.el9.noarch",
                  "product_id": "osbuild-lvm2-0:141-1.el9.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-lvm2@141-1.el9?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-ostree-0:141-1.el9.noarch",
                "product": {
                  "name": "osbuild-ostree-0:141-1.el9.noarch",
                  "product_id": "osbuild-ostree-0:141-1.el9.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-ostree@141-1.el9?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-selinux-0:141-1.el9.noarch",
                "product": {
                  "name": "osbuild-selinux-0:141-1.el9.noarch",
                  "product_id": "osbuild-selinux-0:141-1.el9.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-selinux@141-1.el9?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-osbuild-0:141-1.el9.noarch",
                "product": {
                  "name": "python3-osbuild-0:141-1.el9.noarch",
                  "product_id": "python3-osbuild-0:141-1.el9.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-osbuild@141-1.el9?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-0:141-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-0:141-1.el9.noarch"
        },
        "product_reference": "osbuild-0:141-1.el9.noarch",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-0:141-1.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-0:141-1.el9.src"
        },
        "product_reference": "osbuild-0:141-1.el9.src",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-0:132-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.aarch64"
        },
        "product_reference": "osbuild-composer-0:132-1.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-0:132-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.ppc64le"
        },
        "product_reference": "osbuild-composer-0:132-1.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-0:132-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.s390x"
        },
        "product_reference": "osbuild-composer-0:132-1.el9.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-0:132-1.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.src"
        },
        "product_reference": "osbuild-composer-0:132-1.el9.src",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-0:132-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.x86_64"
        },
        "product_reference": "osbuild-composer-0:132-1.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-0:132-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.aarch64"
        },
        "product_reference": "osbuild-composer-core-0:132-1.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-0:132-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.ppc64le"
        },
        "product_reference": "osbuild-composer-core-0:132-1.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-0:132-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.s390x"
        },
        "product_reference": "osbuild-composer-core-0:132-1.el9.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-0:132-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.x86_64"
        },
        "product_reference": "osbuild-composer-core-0:132-1.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-debuginfo-0:132-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.aarch64"
        },
        "product_reference": "osbuild-composer-core-debuginfo-0:132-1.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le"
        },
        "product_reference": "osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-debuginfo-0:132-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.s390x"
        },
        "product_reference": "osbuild-composer-core-debuginfo-0:132-1.el9.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-debuginfo-0:132-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.x86_64"
        },
        "product_reference": "osbuild-composer-core-debuginfo-0:132-1.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debuginfo-0:132-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.aarch64"
        },
        "product_reference": "osbuild-composer-debuginfo-0:132-1.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debuginfo-0:132-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.ppc64le"
        },
        "product_reference": "osbuild-composer-debuginfo-0:132-1.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debuginfo-0:132-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.s390x"
        },
        "product_reference": "osbuild-composer-debuginfo-0:132-1.el9.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debuginfo-0:132-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.x86_64"
        },
        "product_reference": "osbuild-composer-debuginfo-0:132-1.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debugsource-0:132-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.aarch64"
        },
        "product_reference": "osbuild-composer-debugsource-0:132-1.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debugsource-0:132-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.ppc64le"
        },
        "product_reference": "osbuild-composer-debugsource-0:132-1.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debugsource-0:132-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.s390x"
        },
        "product_reference": "osbuild-composer-debugsource-0:132-1.el9.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debugsource-0:132-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.x86_64"
        },
        "product_reference": "osbuild-composer-debugsource-0:132-1.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64"
        },
        "product_reference": "osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le"
        },
        "product_reference": "osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-tests-debuginfo-0:132-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.s390x"
        },
        "product_reference": "osbuild-composer-tests-debuginfo-0:132-1.el9.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64"
        },
        "product_reference": "osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-0:132-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.aarch64"
        },
        "product_reference": "osbuild-composer-worker-0:132-1.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-0:132-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.ppc64le"
        },
        "product_reference": "osbuild-composer-worker-0:132-1.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-0:132-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.s390x"
        },
        "product_reference": "osbuild-composer-worker-0:132-1.el9.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-0:132-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.x86_64"
        },
        "product_reference": "osbuild-composer-worker-0:132-1.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64"
        },
        "product_reference": "osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le"
        },
        "product_reference": "osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-debuginfo-0:132-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.s390x"
        },
        "product_reference": "osbuild-composer-worker-debuginfo-0:132-1.el9.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64"
        },
        "product_reference": "osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-depsolve-dnf-0:141-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-depsolve-dnf-0:141-1.el9.noarch"
        },
        "product_reference": "osbuild-depsolve-dnf-0:141-1.el9.noarch",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-luks2-0:141-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-luks2-0:141-1.el9.noarch"
        },
        "product_reference": "osbuild-luks2-0:141-1.el9.noarch",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-lvm2-0:141-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-lvm2-0:141-1.el9.noarch"
        },
        "product_reference": "osbuild-lvm2-0:141-1.el9.noarch",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-ostree-0:141-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-ostree-0:141-1.el9.noarch"
        },
        "product_reference": "osbuild-ostree-0:141-1.el9.noarch",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-selinux-0:141-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:osbuild-selinux-0:141-1.el9.noarch"
        },
        "product_reference": "osbuild-selinux-0:141-1.el9.noarch",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-osbuild-0:141-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:python3-osbuild-0:141-1.el9.noarch"
        },
        "product_reference": "python3-osbuild-0:141-1.el9.noarch",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "@r3kumar",
            "@qmuntal"
          ]
        }
      ],
      "cve": "CVE-2024-1394",
      "cwe": {
        "id": "CWE-401",
        "name": "Missing Release of Memory after Effective Lifetime"
      },
      "discovery_date": "2024-02-06T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-depsolve-dnf-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-luks2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-lvm2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-ostree-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-selinux-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:python3-osbuild-0:141-1.el9.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2262921"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs\u200b. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey\u200b and ctx\u200b. That function uses named return parameters to free pkey\u200b and ctx\u200b if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the \"return nil, nil, fail(...)\" pattern, meaning that pkey\u200b and ctx\u200b will be nil inside the deferred function that should free them.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The majority of RHEL utilities are not long-running applications; instead, they are command-line tools. These tools utilize Golang package as build-time dependency, which is why they are classified as having a \"Moderate\" level of impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.src",
          "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.6.0.GA:osbuild-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:osbuild-0:141-1.el9.src",
          "AppStream-9.6.0.GA:osbuild-depsolve-dnf-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:osbuild-luks2-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:osbuild-lvm2-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:osbuild-ostree-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:osbuild-selinux-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:python3-osbuild-0:141-1.el9.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-1394"
        },
        {
          "category": "external",
          "summary": "RHBZ#2262921",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262921"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-1394",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-1394"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-1394",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1394"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136",
          "url": "https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6",
          "url": "https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6"
        },
        {
          "category": "external",
          "summary": "https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f",
          "url": "https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-2660",
          "url": "https://pkg.go.dev/vuln/GO-2024-2660"
        },
        {
          "category": "external",
          "summary": "https://vuln.go.dev/ID/GO-2024-2660.json",
          "url": "https://vuln.go.dev/ID/GO-2024-2660.json"
        }
      ],
      "release_date": "2024-03-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:41:23+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7118"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-depsolve-dnf-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-luks2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-lvm2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-ostree-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-selinux-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:python3-osbuild-0:141-1.el9.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-depsolve-dnf-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-luks2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-lvm2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-ostree-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-selinux-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:python3-osbuild-0:141-1.el9.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-depsolve-dnf-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-luks2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-lvm2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-ostree-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-selinux-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:python3-osbuild-0:141-1.el9.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.src",
          "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.6.0.GA:osbuild-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:osbuild-0:141-1.el9.src",
          "AppStream-9.6.0.GA:osbuild-depsolve-dnf-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:osbuild-luks2-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:osbuild-lvm2-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:osbuild-ostree-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:osbuild-selinux-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:python3-osbuild-0:141-1.el9.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:41:23+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7118"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-depsolve-dnf-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-luks2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-lvm2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-ostree-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-selinux-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:python3-osbuild-0:141-1.el9.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-depsolve-dnf-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-luks2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-lvm2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-ostree-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-selinux-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:python3-osbuild-0:141-1.el9.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    },
    {
      "cve": "CVE-2024-34158",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "discovery_date": "2024-09-06T21:20:12.126400+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-depsolve-dnf-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-luks2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-lvm2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-ostree-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-selinux-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:python3-osbuild-0:141-1.el9.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2310529"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the go/build/constraint package of the Golang standard library. Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "go/build/constraint: golang: Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.src",
          "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.x86_64",
          "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64",
          "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le",
          "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.s390x",
          "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64"
        ],
        "known_not_affected": [
          "AppStream-9.6.0.GA:osbuild-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:osbuild-0:141-1.el9.src",
          "AppStream-9.6.0.GA:osbuild-depsolve-dnf-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:osbuild-luks2-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:osbuild-lvm2-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:osbuild-ostree-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:osbuild-selinux-0:141-1.el9.noarch",
          "AppStream-9.6.0.GA:python3-osbuild-0:141-1.el9.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-34158"
        },
        {
          "category": "external",
          "summary": "RHBZ#2310529",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310529"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-34158",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-34158"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-34158",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34158"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/611240",
          "url": "https://go.dev/cl/611240"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/69141",
          "url": "https://go.dev/issue/69141"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk",
          "url": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-3107",
          "url": "https://pkg.go.dev/vuln/GO-2024-3107"
        }
      ],
      "release_date": "2024-09-06T21:15:12.083000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:41:23+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7118"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-depsolve-dnf-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-luks2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-lvm2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-ostree-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-selinux-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:python3-osbuild-0:141-1.el9.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-0:141-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.src",
            "AppStream-9.6.0.GA:osbuild-composer-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-core-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-debugsource-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-tests-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.aarch64",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.ppc64le",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.s390x",
            "AppStream-9.6.0.GA:osbuild-composer-worker-debuginfo-0:132-1.el9.x86_64",
            "AppStream-9.6.0.GA:osbuild-depsolve-dnf-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-luks2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-lvm2-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-ostree-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:osbuild-selinux-0:141-1.el9.noarch",
            "AppStream-9.6.0.GA:python3-osbuild-0:141-1.el9.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "go/build/constraint: golang: Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for golang is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:7550",
        "url": "https://access.redhat.com/errata/RHSA-2024:7550"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7550.json"
      }
    ],
    "title": "Red Hat Security Advisory: golang security update",
    "tracking": {
      "current_release_date": "2025-01-06T22:02:51+00:00",
      "generator": {
        "date": "2025-01-06T22:02:51+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.5"
        }
      },
      "id": "RHSA-2024:7550",
      "initial_release_date": "2024-10-02T18:24:59+00:00",
      "revision_history": [
        {
          "date": "2024-10-02T18:24:59+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-02T18:24:59+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-01-06T22:02:51+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.4.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-4.el9_4.aarch64",
                "product": {
                  "name": "go-toolset-0:1.21.13-4.el9_4.aarch64",
                  "product_id": "go-toolset-0:1.21.13-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-4.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-4.el9_4.aarch64",
                "product": {
                  "name": "golang-0:1.21.13-4.el9_4.aarch64",
                  "product_id": "golang-0:1.21.13-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-4.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-4.el9_4.aarch64",
                "product": {
                  "name": "golang-bin-0:1.21.13-4.el9_4.aarch64",
                  "product_id": "golang-bin-0:1.21.13-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-4.el9_4?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-4.el9_4.ppc64le",
                "product": {
                  "name": "go-toolset-0:1.21.13-4.el9_4.ppc64le",
                  "product_id": "go-toolset-0:1.21.13-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-4.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-4.el9_4.ppc64le",
                "product": {
                  "name": "golang-0:1.21.13-4.el9_4.ppc64le",
                  "product_id": "golang-0:1.21.13-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-4.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-4.el9_4.ppc64le",
                "product": {
                  "name": "golang-bin-0:1.21.13-4.el9_4.ppc64le",
                  "product_id": "golang-bin-0:1.21.13-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-4.el9_4?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-4.el9_4.x86_64",
                "product": {
                  "name": "go-toolset-0:1.21.13-4.el9_4.x86_64",
                  "product_id": "go-toolset-0:1.21.13-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-4.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-4.el9_4.x86_64",
                "product": {
                  "name": "golang-0:1.21.13-4.el9_4.x86_64",
                  "product_id": "golang-0:1.21.13-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-4.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-4.el9_4.x86_64",
                "product": {
                  "name": "golang-bin-0:1.21.13-4.el9_4.x86_64",
                  "product_id": "golang-bin-0:1.21.13-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-4.el9_4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-4.el9_4.s390x",
                "product": {
                  "name": "go-toolset-0:1.21.13-4.el9_4.s390x",
                  "product_id": "go-toolset-0:1.21.13-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-4.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-4.el9_4.s390x",
                "product": {
                  "name": "golang-0:1.21.13-4.el9_4.s390x",
                  "product_id": "golang-0:1.21.13-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-4.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-4.el9_4.s390x",
                "product": {
                  "name": "golang-bin-0:1.21.13-4.el9_4.s390x",
                  "product_id": "golang-bin-0:1.21.13-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-4.el9_4?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-4.el9_4.src",
                "product": {
                  "name": "golang-0:1.21.13-4.el9_4.src",
                  "product_id": "golang-0:1.21.13-4.el9_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-4.el9_4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-docs-0:1.21.13-4.el9_4.noarch",
                "product": {
                  "name": "golang-docs-0:1.21.13-4.el9_4.noarch",
                  "product_id": "golang-docs-0:1.21.13-4.el9_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-docs@1.21.13-4.el9_4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-misc-0:1.21.13-4.el9_4.noarch",
                "product": {
                  "name": "golang-misc-0:1.21.13-4.el9_4.noarch",
                  "product_id": "golang-misc-0:1.21.13-4.el9_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-misc@1.21.13-4.el9_4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-src-0:1.21.13-4.el9_4.noarch",
                "product": {
                  "name": "golang-src-0:1.21.13-4.el9_4.noarch",
                  "product_id": "golang-src-0:1.21.13-4.el9_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-src@1.21.13-4.el9_4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-tests-0:1.21.13-4.el9_4.noarch",
                "product": {
                  "name": "golang-tests-0:1.21.13-4.el9_4.noarch",
                  "product_id": "golang-tests-0:1.21.13-4.el9_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-tests@1.21.13-4.el9_4?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.aarch64"
        },
        "product_reference": "go-toolset-0:1.21.13-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.ppc64le"
        },
        "product_reference": "go-toolset-0:1.21.13-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.s390x"
        },
        "product_reference": "go-toolset-0:1.21.13-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.x86_64"
        },
        "product_reference": "go-toolset-0:1.21.13-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.aarch64"
        },
        "product_reference": "golang-0:1.21.13-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.ppc64le"
        },
        "product_reference": "golang-0:1.21.13-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.s390x"
        },
        "product_reference": "golang-0:1.21.13-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-4.el9_4.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.src"
        },
        "product_reference": "golang-0:1.21.13-4.el9_4.src",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.x86_64"
        },
        "product_reference": "golang-0:1.21.13-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.aarch64"
        },
        "product_reference": "golang-bin-0:1.21.13-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.ppc64le"
        },
        "product_reference": "golang-bin-0:1.21.13-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.s390x"
        },
        "product_reference": "golang-bin-0:1.21.13-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.x86_64"
        },
        "product_reference": "golang-bin-0:1.21.13-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-docs-0:1.21.13-4.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-docs-0:1.21.13-4.el9_4.noarch"
        },
        "product_reference": "golang-docs-0:1.21.13-4.el9_4.noarch",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-misc-0:1.21.13-4.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-misc-0:1.21.13-4.el9_4.noarch"
        },
        "product_reference": "golang-misc-0:1.21.13-4.el9_4.noarch",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-src-0:1.21.13-4.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-src-0:1.21.13-4.el9_4.noarch"
        },
        "product_reference": "golang-src-0:1.21.13-4.el9_4.noarch",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-tests-0:1.21.13-4.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-tests-0:1.21.13-4.el9_4.noarch"
        },
        "product_reference": "golang-tests-0:1.21.13-4.el9_4.noarch",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.src",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-docs-0:1.21.13-4.el9_4.noarch",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-misc-0:1.21.13-4.el9_4.noarch",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-src-0:1.21.13-4.el9_4.noarch",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-tests-0:1.21.13-4.el9_4.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-02T18:24:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-docs-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-misc-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-src-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-tests-0:1.21.13-4.el9_4.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7550"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-docs-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-misc-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-src-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-tests-0:1.21.13-4.el9_4.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-docs-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-misc-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-src-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-tests-0:1.21.13-4.el9_4.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for rhc-worker-script is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Remote Host Configuration (rhc) worker for executing scripts on hosts managed by Red Hat Insights.\n\nSecurity Fix(es):\n\n* net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:10133",
        "url": "https://access.redhat.com/errata/RHSA-2024:10133"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2295310",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295310"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10133.json"
      }
    ],
    "title": "Red Hat Security Advisory: rhc-worker-script security update",
    "tracking": {
      "current_release_date": "2025-07-17T14:43:10+00:00",
      "generator": {
        "date": "2025-07-17T14:43:10+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.3"
        }
      },
      "id": "RHSA-2024:10133",
      "initial_release_date": "2024-11-21T01:11:03+00:00",
      "revision_history": [
        {
          "date": "2024-11-21T01:11:03+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-11-21T01:11:03+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-17T14:43:10+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server (v. 7 ELS)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server (v. 7 ELS)",
                  "product_id": "7Server-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_els:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhc-worker-script-0:0.10-2.el7_9.src",
                "product": {
                  "name": "rhc-worker-script-0:0.10-2.el7_9.src",
                  "product_id": "rhc-worker-script-0:0.10-2.el7_9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhc-worker-script@0.10-2.el7_9?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhc-worker-script-0:0.10-2.el7_9.x86_64",
                "product": {
                  "name": "rhc-worker-script-0:0.10-2.el7_9.x86_64",
                  "product_id": "rhc-worker-script-0:0.10-2.el7_9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhc-worker-script@0.10-2.el7_9?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhc-worker-script-0:0.10-2.el7_9.src as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src"
        },
        "product_reference": "rhc-worker-script-0:0.10-2.el7_9.src",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhc-worker-script-0:0.10-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
        },
        "product_reference": "rhc-worker-script-0:0.10-2.el7_9.x86_64",
        "relates_to_product_reference": "7Server-ELS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
          "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-21T01:11:03+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:10133"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    },
    {
      "cve": "CVE-2024-24791",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2024-07-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2295310"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go. The net/http module mishandles specific server responses from HTTP/1.1 client requests. This issue may render a connection invalid and cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: Denial of service due to improper 100-continue handling in net/http",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An attacker would need to control a malicious server and induce a client to connect to it, requiring some amount of preparation outside of the attacker\u0027s control. This reduces the severity score of this flaw to Moderate.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-20: Improper Input Validation vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nRed Hat enforces the principle of least functionality, ensuring that only essential features, services, and ports are enabled. This minimizes the number of components that could be affected by input validation vulnerabilities. Security testing and evaluation standards are implemented within the environment to rigorously test input validation mechanisms during the development lifecycle, while static code analysis identifies potential input validation vulnerabilities by default. Process isolation ensures that processes handling potentially malicious or unvalidated inputs run in isolated environments by separating execution domains for each process. Malicious code protections, such as IPS/IDS and antimalware solutions, help detect and mitigate malicious payloads stemming from input validation vulnerabilities. Finally, robust input validation and error-handling mechanisms ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks further.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
          "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "RHBZ#2295310",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295310"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-24791",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24791",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/591255",
          "url": "https://go.dev/cl/591255"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/67555",
          "url": "https://go.dev/issue/67555"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ",
          "url": "https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ"
        }
      ],
      "release_date": "2024-07-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-21T01:11:03+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:10133"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: Denial of service due to improper 100-continue handling in net/http"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for rhc-worker-script is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Remote Host Configuration (rhc) worker for executing scripts on hosts managed by Red Hat Insights.\n\nSecurity Fix(es):\n\n* net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:10133",
        "url": "https://access.redhat.com/errata/RHSA-2024:10133"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2295310",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295310"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10133.json"
      }
    ],
    "title": "Red Hat Security Advisory: rhc-worker-script security update",
    "tracking": {
      "current_release_date": "2025-07-17T14:43:10+00:00",
      "generator": {
        "date": "2025-07-17T14:43:10+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.3"
        }
      },
      "id": "RHSA-2024:10133",
      "initial_release_date": "2024-11-21T01:11:03+00:00",
      "revision_history": [
        {
          "date": "2024-11-21T01:11:03+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-11-21T01:11:03+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-17T14:43:10+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server (v. 7 ELS)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server (v. 7 ELS)",
                  "product_id": "7Server-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_els:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhc-worker-script-0:0.10-2.el7_9.src",
                "product": {
                  "name": "rhc-worker-script-0:0.10-2.el7_9.src",
                  "product_id": "rhc-worker-script-0:0.10-2.el7_9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhc-worker-script@0.10-2.el7_9?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhc-worker-script-0:0.10-2.el7_9.x86_64",
                "product": {
                  "name": "rhc-worker-script-0:0.10-2.el7_9.x86_64",
                  "product_id": "rhc-worker-script-0:0.10-2.el7_9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhc-worker-script@0.10-2.el7_9?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhc-worker-script-0:0.10-2.el7_9.src as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src"
        },
        "product_reference": "rhc-worker-script-0:0.10-2.el7_9.src",
        "relates_to_product_reference": "7Server-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhc-worker-script-0:0.10-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
          "product_id": "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
        },
        "product_reference": "rhc-worker-script-0:0.10-2.el7_9.x86_64",
        "relates_to_product_reference": "7Server-ELS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
          "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-21T01:11:03+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:10133"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    },
    {
      "cve": "CVE-2024-24791",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2024-07-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2295310"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go. The net/http module mishandles specific server responses from HTTP/1.1 client requests. This issue may render a connection invalid and cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: Denial of service due to improper 100-continue handling in net/http",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An attacker would need to control a malicious server and induce a client to connect to it, requiring some amount of preparation outside of the attacker\u0027s control. This reduces the severity score of this flaw to Moderate.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-20: Improper Input Validation vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nRed Hat enforces the principle of least functionality, ensuring that only essential features, services, and ports are enabled. This minimizes the number of components that could be affected by input validation vulnerabilities. Security testing and evaluation standards are implemented within the environment to rigorously test input validation mechanisms during the development lifecycle, while static code analysis identifies potential input validation vulnerabilities by default. Process isolation ensures that processes handling potentially malicious or unvalidated inputs run in isolated environments by separating execution domains for each process. Malicious code protections, such as IPS/IDS and antimalware solutions, help detect and mitigate malicious payloads stemming from input validation vulnerabilities. Finally, robust input validation and error-handling mechanisms ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks further.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
          "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "RHBZ#2295310",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295310"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-24791",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24791",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/591255",
          "url": "https://go.dev/cl/591255"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/67555",
          "url": "https://go.dev/issue/67555"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ",
          "url": "https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ"
        }
      ],
      "release_date": "2024-07-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-21T01:11:03+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:10133"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.src",
            "7Server-ELS:rhc-worker-script-0:0.10-2.el7_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: Denial of service due to improper 100-continue handling in net/http"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:7502",
        "url": "https://access.redhat.com/errata/RHSA-2024:7502"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7502.json"
      }
    ],
    "title": "Red Hat Security Advisory: go-toolset:rhel8 security update",
    "tracking": {
      "current_release_date": "2025-07-10T01:48:16+00:00",
      "generator": {
        "date": "2025-07-10T01:48:16+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.3"
        }
      },
      "id": "RHSA-2024:7502",
      "initial_release_date": "2024-10-02T11:50:23+00:00",
      "revision_history": [
        {
          "date": "2024-10-02T11:50:23+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-02T11:50:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-10T01:48:16+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset:rhel8:8100020241001112709:a3795dee",
                "product": {
                  "name": "go-toolset:rhel8:8100020241001112709:a3795dee",
                  "product_id": "go-toolset:rhel8:8100020241001112709:a3795dee",
                  "product_identification_helper": {
                    "purl": "pkg:rpmmod/redhat/go-toolset@rhel8:8100020241001112709:a3795dee"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                "product": {
                  "name": "golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_id": "golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-docs@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                "product": {
                  "name": "golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_id": "golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-misc@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                "product": {
                  "name": "golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_id": "golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-src@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                "product": {
                  "name": "golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_id": "golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-tests@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
                "product": {
                  "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
                  "product_id": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
                "product": {
                  "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
                  "product_id": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-1.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
                "product": {
                  "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
                  "product_id": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                "product": {
                  "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_id": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                "product": {
                  "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_id": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debuginfo@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                "product": {
                  "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_id": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debugsource@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
                "product": {
                  "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_id": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-1.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                "product": {
                  "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                  "product_id": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                "product": {
                  "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                  "product_id": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                "product": {
                  "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_id": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                "product": {
                  "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_id": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debuginfo@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                "product": {
                  "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_id": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debugsource@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                "product": {
                  "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_id": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-1.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                "product": {
                  "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                  "product_id": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                "product": {
                  "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                  "product_id": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                "product": {
                  "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_id": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                "product": {
                  "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_id": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debuginfo@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                "product": {
                  "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_id": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debugsource@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
                "product": {
                  "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_id": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-1.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                "product": {
                  "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                  "product_id": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                "product": {
                  "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                  "product_id": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
                "product": {
                  "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
                  "product_id": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-1.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                "product": {
                  "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                  "product_id": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                "product": {
                  "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                  "product_id": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
        },
        "product_reference": "go-toolset:rhel8:8100020241001112709:a3795dee",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64"
        },
        "product_reference": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le"
        },
        "product_reference": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src"
        },
        "product_reference": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64"
        },
        "product_reference": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64"
        },
        "product_reference": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le"
        },
        "product_reference": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64"
        },
        "product_reference": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64"
        },
        "product_reference": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le"
        },
        "product_reference": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64"
        },
        "product_reference": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64"
        },
        "product_reference": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le"
        },
        "product_reference": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x"
        },
        "product_reference": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src"
        },
        "product_reference": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64"
        },
        "product_reference": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64"
        },
        "product_reference": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le"
        },
        "product_reference": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x"
        },
        "product_reference": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src"
        },
        "product_reference": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64"
        },
        "product_reference": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64"
        },
        "product_reference": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le"
        },
        "product_reference": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x"
        },
        "product_reference": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64"
        },
        "product_reference": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
        },
        "product_reference": "golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
        },
        "product_reference": "golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
        },
        "product_reference": "golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
        },
        "product_reference": "golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-02T11:50:23+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7502"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:7502",
        "url": "https://access.redhat.com/errata/RHSA-2024:7502"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7502.json"
      }
    ],
    "title": "Red Hat Security Advisory: go-toolset:rhel8 security update",
    "tracking": {
      "current_release_date": "2025-01-06T22:02:40+00:00",
      "generator": {
        "date": "2025-01-06T22:02:40+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.5"
        }
      },
      "id": "RHSA-2024:7502",
      "initial_release_date": "2024-10-02T11:50:23+00:00",
      "revision_history": [
        {
          "date": "2024-10-02T11:50:23+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-02T11:50:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-01-06T22:02:40+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset:rhel8:8100020241001112709:a3795dee",
                "product": {
                  "name": "go-toolset:rhel8:8100020241001112709:a3795dee",
                  "product_id": "go-toolset:rhel8:8100020241001112709:a3795dee",
                  "product_identification_helper": {
                    "purl": "pkg:rpmmod/redhat/go-toolset@rhel8:8100020241001112709:a3795dee"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                "product": {
                  "name": "golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_id": "golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-docs@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                "product": {
                  "name": "golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_id": "golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-misc@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                "product": {
                  "name": "golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_id": "golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-src@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                "product": {
                  "name": "golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_id": "golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-tests@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
                "product": {
                  "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
                  "product_id": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
                "product": {
                  "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
                  "product_id": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-1.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
                "product": {
                  "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
                  "product_id": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                "product": {
                  "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_id": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                "product": {
                  "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_id": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debuginfo@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                "product": {
                  "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_id": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debugsource@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
                "product": {
                  "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_id": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-1.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                "product": {
                  "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                  "product_id": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                "product": {
                  "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                  "product_id": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                "product": {
                  "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_id": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                "product": {
                  "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_id": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debuginfo@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                "product": {
                  "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_id": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debugsource@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                "product": {
                  "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_id": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-1.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                "product": {
                  "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                  "product_id": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                "product": {
                  "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                  "product_id": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                "product": {
                  "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_id": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                "product": {
                  "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_id": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debuginfo@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                "product": {
                  "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_id": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debugsource@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
                "product": {
                  "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_id": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-1.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                "product": {
                  "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                  "product_id": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                "product": {
                  "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                  "product_id": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
                "product": {
                  "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
                  "product_id": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-1.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                "product": {
                  "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                  "product_id": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                "product": {
                  "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                  "product_id": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
        },
        "product_reference": "go-toolset:rhel8:8100020241001112709:a3795dee",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64"
        },
        "product_reference": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le"
        },
        "product_reference": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src"
        },
        "product_reference": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64"
        },
        "product_reference": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64"
        },
        "product_reference": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le"
        },
        "product_reference": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64"
        },
        "product_reference": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64"
        },
        "product_reference": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le"
        },
        "product_reference": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64"
        },
        "product_reference": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64"
        },
        "product_reference": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le"
        },
        "product_reference": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x"
        },
        "product_reference": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src"
        },
        "product_reference": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64"
        },
        "product_reference": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64"
        },
        "product_reference": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le"
        },
        "product_reference": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x"
        },
        "product_reference": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src"
        },
        "product_reference": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64"
        },
        "product_reference": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64"
        },
        "product_reference": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le"
        },
        "product_reference": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x"
        },
        "product_reference": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64"
        },
        "product_reference": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
        },
        "product_reference": "golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
        },
        "product_reference": "golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
        },
        "product_reference": "golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
        },
        "product_reference": "golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-02T11:50:23+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7502"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for grafana-pcp is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.\n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:8847",
        "url": "https://access.redhat.com/errata/RHSA-2024:8847"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8847.json"
      }
    ],
    "title": "Red Hat Security Advisory: grafana-pcp security update",
    "tracking": {
      "current_release_date": "2025-01-06T22:04:13+00:00",
      "generator": {
        "date": "2025-01-06T22:04:13+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.5"
        }
      },
      "id": "RHSA-2024:8847",
      "initial_release_date": "2024-11-05T03:58:20+00:00",
      "revision_history": [
        {
          "date": "2024-11-05T03:58:20+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-11-05T03:58:20+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-01-06T22:04:13+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-9.el8_10.src",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-9.el8_10.src",
                  "product_id": "grafana-pcp-0:5.1.1-9.el8_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-9.el8_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-9.el8_10.aarch64",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-9.el8_10.aarch64",
                  "product_id": "grafana-pcp-0:5.1.1-9.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-9.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-9.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-9.el8_10?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
                  "product_id": "grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-9.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-9.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-9.el8_10?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-9.el8_10.x86_64",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-9.el8_10.x86_64",
                  "product_id": "grafana-pcp-0:5.1.1-9.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-9.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-9.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-9.el8_10?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-9.el8_10.s390x",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-9.el8_10.s390x",
                  "product_id": "grafana-pcp-0:5.1.1-9.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-9.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-9.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-9.el8_10?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-9.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.aarch64"
        },
        "product_reference": "grafana-pcp-0:5.1.1-9.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-9.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.ppc64le"
        },
        "product_reference": "grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-9.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.s390x"
        },
        "product_reference": "grafana-pcp-0:5.1.1-9.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-9.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.src"
        },
        "product_reference": "grafana-pcp-0:5.1.1-9.el8_10.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-9.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.x86_64"
        },
        "product_reference": "grafana-pcp-0:5.1.1-9.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-05T03:58:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8847"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for grafana is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\n* dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:8327",
        "url": "https://access.redhat.com/errata/RHSA-2024:8327"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "external",
        "summary": "2318052",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318052"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8327.json"
      }
    ],
    "title": "Red Hat Security Advisory: grafana security update",
    "tracking": {
      "current_release_date": "2025-07-14T20:50:14+00:00",
      "generator": {
        "date": "2025-07-14T20:50:14+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.3"
        }
      },
      "id": "RHSA-2024:8327",
      "initial_release_date": "2024-10-22T15:15:27+00:00",
      "revision_history": [
        {
          "date": "2024-10-22T15:15:27+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-22T15:15:27+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-14T20:50:14+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-20.el8_10.src",
                "product": {
                  "name": "grafana-0:9.2.10-20.el8_10.src",
                  "product_id": "grafana-0:9.2.10-20.el8_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-20.el8_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-20.el8_10.aarch64",
                "product": {
                  "name": "grafana-0:9.2.10-20.el8_10.aarch64",
                  "product_id": "grafana-0:9.2.10-20.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-20.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-20.el8_10.aarch64",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-20.el8_10.aarch64",
                  "product_id": "grafana-selinux-0:9.2.10-20.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-20.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
                  "product_id": "grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-20.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
                  "product_id": "grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-20.el8_10?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-20.el8_10.ppc64le",
                "product": {
                  "name": "grafana-0:9.2.10-20.el8_10.ppc64le",
                  "product_id": "grafana-0:9.2.10-20.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-20.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
                  "product_id": "grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-20.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
                  "product_id": "grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-20.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
                  "product_id": "grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-20.el8_10?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-20.el8_10.x86_64",
                "product": {
                  "name": "grafana-0:9.2.10-20.el8_10.x86_64",
                  "product_id": "grafana-0:9.2.10-20.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-20.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-20.el8_10.x86_64",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-20.el8_10.x86_64",
                  "product_id": "grafana-selinux-0:9.2.10-20.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-20.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
                  "product_id": "grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-20.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
                  "product_id": "grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-20.el8_10?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-20.el8_10.s390x",
                "product": {
                  "name": "grafana-0:9.2.10-20.el8_10.s390x",
                  "product_id": "grafana-0:9.2.10-20.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-20.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-20.el8_10.s390x",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-20.el8_10.s390x",
                  "product_id": "grafana-selinux-0:9.2.10-20.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-20.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-20.el8_10.s390x",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-20.el8_10.s390x",
                  "product_id": "grafana-debugsource-0:9.2.10-20.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-20.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
                  "product_id": "grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-20.el8_10?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-20.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64"
        },
        "product_reference": "grafana-0:9.2.10-20.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-20.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le"
        },
        "product_reference": "grafana-0:9.2.10-20.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-20.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x"
        },
        "product_reference": "grafana-0:9.2.10-20.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-20.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src"
        },
        "product_reference": "grafana-0:9.2.10-20.el8_10.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-20.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64"
        },
        "product_reference": "grafana-0:9.2.10-20.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-20.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-20.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-20.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-20.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-20.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-20.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-20.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-20.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-20.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64"
        },
        "product_reference": "grafana-selinux-0:9.2.10-20.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-20.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le"
        },
        "product_reference": "grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-20.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x"
        },
        "product_reference": "grafana-selinux-0:9.2.10-20.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-20.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
        },
        "product_reference": "grafana-selinux-0:9.2.10-20.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-22T15:15:27+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8327"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    },
    {
      "cve": "CVE-2024-47875",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2024-10-11T15:20:07.304345+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2318052"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: nesting-based mutation XSS vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "RHBZ#2318052",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318052"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47875",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47875",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098",
          "url": "https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f",
          "url": "https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a",
          "url": "https://github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf"
        }
      ],
      "release_date": "2024-10-11T15:15:05.860000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-22T15:15:27+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8327"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dompurify: nesting-based mutation XSS vulnerability"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for grafana is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\n* dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:8678",
        "url": "https://access.redhat.com/errata/RHSA-2024:8678"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "external",
        "summary": "2318052",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318052"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8678.json"
      }
    ],
    "title": "Red Hat Security Advisory: grafana security update",
    "tracking": {
      "current_release_date": "2025-07-14T20:51:13+00:00",
      "generator": {
        "date": "2025-07-14T20:51:13+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.3"
        }
      },
      "id": "RHSA-2024:8678",
      "initial_release_date": "2024-10-30T19:42:46+00:00",
      "revision_history": [
        {
          "date": "2024-10-30T19:42:46+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-30T19:42:46+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-14T20:51:13+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.4.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-19.el9_4.src",
                "product": {
                  "name": "grafana-0:9.2.10-19.el9_4.src",
                  "product_id": "grafana-0:9.2.10-19.el9_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-19.el9_4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-19.el9_4.aarch64",
                "product": {
                  "name": "grafana-0:9.2.10-19.el9_4.aarch64",
                  "product_id": "grafana-0:9.2.10-19.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-19.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-19.el9_4.aarch64",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-19.el9_4.aarch64",
                  "product_id": "grafana-selinux-0:9.2.10-19.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-19.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
                  "product_id": "grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-19.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
                  "product_id": "grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-19.el9_4?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-19.el9_4.ppc64le",
                "product": {
                  "name": "grafana-0:9.2.10-19.el9_4.ppc64le",
                  "product_id": "grafana-0:9.2.10-19.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-19.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
                  "product_id": "grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-19.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
                  "product_id": "grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-19.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
                  "product_id": "grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-19.el9_4?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-19.el9_4.x86_64",
                "product": {
                  "name": "grafana-0:9.2.10-19.el9_4.x86_64",
                  "product_id": "grafana-0:9.2.10-19.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-19.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-19.el9_4.x86_64",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-19.el9_4.x86_64",
                  "product_id": "grafana-selinux-0:9.2.10-19.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-19.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
                  "product_id": "grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-19.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
                  "product_id": "grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-19.el9_4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-19.el9_4.s390x",
                "product": {
                  "name": "grafana-0:9.2.10-19.el9_4.s390x",
                  "product_id": "grafana-0:9.2.10-19.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-19.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-19.el9_4.s390x",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-19.el9_4.s390x",
                  "product_id": "grafana-selinux-0:9.2.10-19.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-19.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-19.el9_4.s390x",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-19.el9_4.s390x",
                  "product_id": "grafana-debugsource-0:9.2.10-19.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-19.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
                  "product_id": "grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-19.el9_4?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-19.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64"
        },
        "product_reference": "grafana-0:9.2.10-19.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-19.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le"
        },
        "product_reference": "grafana-0:9.2.10-19.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-19.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x"
        },
        "product_reference": "grafana-0:9.2.10-19.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-19.el9_4.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src"
        },
        "product_reference": "grafana-0:9.2.10-19.el9_4.src",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-19.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64"
        },
        "product_reference": "grafana-0:9.2.10-19.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-19.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-19.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-19.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-19.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-19.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-19.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-19.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-19.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-19.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64"
        },
        "product_reference": "grafana-selinux-0:9.2.10-19.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-19.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le"
        },
        "product_reference": "grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-19.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x"
        },
        "product_reference": "grafana-selinux-0:9.2.10-19.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-19.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
        },
        "product_reference": "grafana-selinux-0:9.2.10-19.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-30T19:42:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8678"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    },
    {
      "cve": "CVE-2024-47875",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2024-10-11T15:20:07.304345+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2318052"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: nesting-based mutation XSS vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "RHBZ#2318052",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318052"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47875",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47875",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098",
          "url": "https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f",
          "url": "https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a",
          "url": "https://github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf"
        }
      ],
      "release_date": "2024-10-11T15:15:05.860000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-30T19:42:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8678"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dompurify: nesting-based mutation XSS vulnerability"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for golang is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:7550",
        "url": "https://access.redhat.com/errata/RHSA-2024:7550"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7550.json"
      }
    ],
    "title": "Red Hat Security Advisory: golang security update",
    "tracking": {
      "current_release_date": "2025-07-10T01:48:31+00:00",
      "generator": {
        "date": "2025-07-10T01:48:31+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.3"
        }
      },
      "id": "RHSA-2024:7550",
      "initial_release_date": "2024-10-02T18:24:59+00:00",
      "revision_history": [
        {
          "date": "2024-10-02T18:24:59+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-02T18:24:59+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-10T01:48:31+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.4.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-4.el9_4.aarch64",
                "product": {
                  "name": "go-toolset-0:1.21.13-4.el9_4.aarch64",
                  "product_id": "go-toolset-0:1.21.13-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-4.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-4.el9_4.aarch64",
                "product": {
                  "name": "golang-0:1.21.13-4.el9_4.aarch64",
                  "product_id": "golang-0:1.21.13-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-4.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-4.el9_4.aarch64",
                "product": {
                  "name": "golang-bin-0:1.21.13-4.el9_4.aarch64",
                  "product_id": "golang-bin-0:1.21.13-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-4.el9_4?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-4.el9_4.ppc64le",
                "product": {
                  "name": "go-toolset-0:1.21.13-4.el9_4.ppc64le",
                  "product_id": "go-toolset-0:1.21.13-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-4.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-4.el9_4.ppc64le",
                "product": {
                  "name": "golang-0:1.21.13-4.el9_4.ppc64le",
                  "product_id": "golang-0:1.21.13-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-4.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-4.el9_4.ppc64le",
                "product": {
                  "name": "golang-bin-0:1.21.13-4.el9_4.ppc64le",
                  "product_id": "golang-bin-0:1.21.13-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-4.el9_4?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-4.el9_4.x86_64",
                "product": {
                  "name": "go-toolset-0:1.21.13-4.el9_4.x86_64",
                  "product_id": "go-toolset-0:1.21.13-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-4.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-4.el9_4.x86_64",
                "product": {
                  "name": "golang-0:1.21.13-4.el9_4.x86_64",
                  "product_id": "golang-0:1.21.13-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-4.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-4.el9_4.x86_64",
                "product": {
                  "name": "golang-bin-0:1.21.13-4.el9_4.x86_64",
                  "product_id": "golang-bin-0:1.21.13-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-4.el9_4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-4.el9_4.s390x",
                "product": {
                  "name": "go-toolset-0:1.21.13-4.el9_4.s390x",
                  "product_id": "go-toolset-0:1.21.13-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-4.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-4.el9_4.s390x",
                "product": {
                  "name": "golang-0:1.21.13-4.el9_4.s390x",
                  "product_id": "golang-0:1.21.13-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-4.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-4.el9_4.s390x",
                "product": {
                  "name": "golang-bin-0:1.21.13-4.el9_4.s390x",
                  "product_id": "golang-bin-0:1.21.13-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-4.el9_4?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-4.el9_4.src",
                "product": {
                  "name": "golang-0:1.21.13-4.el9_4.src",
                  "product_id": "golang-0:1.21.13-4.el9_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-4.el9_4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-docs-0:1.21.13-4.el9_4.noarch",
                "product": {
                  "name": "golang-docs-0:1.21.13-4.el9_4.noarch",
                  "product_id": "golang-docs-0:1.21.13-4.el9_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-docs@1.21.13-4.el9_4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-misc-0:1.21.13-4.el9_4.noarch",
                "product": {
                  "name": "golang-misc-0:1.21.13-4.el9_4.noarch",
                  "product_id": "golang-misc-0:1.21.13-4.el9_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-misc@1.21.13-4.el9_4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-src-0:1.21.13-4.el9_4.noarch",
                "product": {
                  "name": "golang-src-0:1.21.13-4.el9_4.noarch",
                  "product_id": "golang-src-0:1.21.13-4.el9_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-src@1.21.13-4.el9_4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-tests-0:1.21.13-4.el9_4.noarch",
                "product": {
                  "name": "golang-tests-0:1.21.13-4.el9_4.noarch",
                  "product_id": "golang-tests-0:1.21.13-4.el9_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-tests@1.21.13-4.el9_4?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.aarch64"
        },
        "product_reference": "go-toolset-0:1.21.13-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.ppc64le"
        },
        "product_reference": "go-toolset-0:1.21.13-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.s390x"
        },
        "product_reference": "go-toolset-0:1.21.13-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.x86_64"
        },
        "product_reference": "go-toolset-0:1.21.13-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.aarch64"
        },
        "product_reference": "golang-0:1.21.13-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.ppc64le"
        },
        "product_reference": "golang-0:1.21.13-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.s390x"
        },
        "product_reference": "golang-0:1.21.13-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-4.el9_4.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.src"
        },
        "product_reference": "golang-0:1.21.13-4.el9_4.src",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.x86_64"
        },
        "product_reference": "golang-0:1.21.13-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.aarch64"
        },
        "product_reference": "golang-bin-0:1.21.13-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.ppc64le"
        },
        "product_reference": "golang-bin-0:1.21.13-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.s390x"
        },
        "product_reference": "golang-bin-0:1.21.13-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.x86_64"
        },
        "product_reference": "golang-bin-0:1.21.13-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-docs-0:1.21.13-4.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-docs-0:1.21.13-4.el9_4.noarch"
        },
        "product_reference": "golang-docs-0:1.21.13-4.el9_4.noarch",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-misc-0:1.21.13-4.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-misc-0:1.21.13-4.el9_4.noarch"
        },
        "product_reference": "golang-misc-0:1.21.13-4.el9_4.noarch",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-src-0:1.21.13-4.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-src-0:1.21.13-4.el9_4.noarch"
        },
        "product_reference": "golang-src-0:1.21.13-4.el9_4.noarch",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-tests-0:1.21.13-4.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-tests-0:1.21.13-4.el9_4.noarch"
        },
        "product_reference": "golang-tests-0:1.21.13-4.el9_4.noarch",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.src",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-docs-0:1.21.13-4.el9_4.noarch",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-misc-0:1.21.13-4.el9_4.noarch",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-src-0:1.21.13-4.el9_4.noarch",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-tests-0:1.21.13-4.el9_4.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-02T18:24:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-docs-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-misc-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-src-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-tests-0:1.21.13-4.el9_4.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7550"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-docs-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-misc-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-src-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-tests-0:1.21.13-4.el9_4.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-docs-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-misc-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-src-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-tests-0:1.21.13-4.el9_4.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for golang is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:7550",
        "url": "https://access.redhat.com/errata/RHSA-2024:7550"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7550.json"
      }
    ],
    "title": "Red Hat Security Advisory: golang security update",
    "tracking": {
      "current_release_date": "2025-07-10T01:48:31+00:00",
      "generator": {
        "date": "2025-07-10T01:48:31+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.3"
        }
      },
      "id": "RHSA-2024:7550",
      "initial_release_date": "2024-10-02T18:24:59+00:00",
      "revision_history": [
        {
          "date": "2024-10-02T18:24:59+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-02T18:24:59+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-10T01:48:31+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.4.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-4.el9_4.aarch64",
                "product": {
                  "name": "go-toolset-0:1.21.13-4.el9_4.aarch64",
                  "product_id": "go-toolset-0:1.21.13-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-4.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-4.el9_4.aarch64",
                "product": {
                  "name": "golang-0:1.21.13-4.el9_4.aarch64",
                  "product_id": "golang-0:1.21.13-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-4.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-4.el9_4.aarch64",
                "product": {
                  "name": "golang-bin-0:1.21.13-4.el9_4.aarch64",
                  "product_id": "golang-bin-0:1.21.13-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-4.el9_4?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-4.el9_4.ppc64le",
                "product": {
                  "name": "go-toolset-0:1.21.13-4.el9_4.ppc64le",
                  "product_id": "go-toolset-0:1.21.13-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-4.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-4.el9_4.ppc64le",
                "product": {
                  "name": "golang-0:1.21.13-4.el9_4.ppc64le",
                  "product_id": "golang-0:1.21.13-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-4.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-4.el9_4.ppc64le",
                "product": {
                  "name": "golang-bin-0:1.21.13-4.el9_4.ppc64le",
                  "product_id": "golang-bin-0:1.21.13-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-4.el9_4?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-4.el9_4.x86_64",
                "product": {
                  "name": "go-toolset-0:1.21.13-4.el9_4.x86_64",
                  "product_id": "go-toolset-0:1.21.13-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-4.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-4.el9_4.x86_64",
                "product": {
                  "name": "golang-0:1.21.13-4.el9_4.x86_64",
                  "product_id": "golang-0:1.21.13-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-4.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-4.el9_4.x86_64",
                "product": {
                  "name": "golang-bin-0:1.21.13-4.el9_4.x86_64",
                  "product_id": "golang-bin-0:1.21.13-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-4.el9_4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-4.el9_4.s390x",
                "product": {
                  "name": "go-toolset-0:1.21.13-4.el9_4.s390x",
                  "product_id": "go-toolset-0:1.21.13-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-4.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-4.el9_4.s390x",
                "product": {
                  "name": "golang-0:1.21.13-4.el9_4.s390x",
                  "product_id": "golang-0:1.21.13-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-4.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-4.el9_4.s390x",
                "product": {
                  "name": "golang-bin-0:1.21.13-4.el9_4.s390x",
                  "product_id": "golang-bin-0:1.21.13-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-4.el9_4?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-4.el9_4.src",
                "product": {
                  "name": "golang-0:1.21.13-4.el9_4.src",
                  "product_id": "golang-0:1.21.13-4.el9_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-4.el9_4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-docs-0:1.21.13-4.el9_4.noarch",
                "product": {
                  "name": "golang-docs-0:1.21.13-4.el9_4.noarch",
                  "product_id": "golang-docs-0:1.21.13-4.el9_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-docs@1.21.13-4.el9_4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-misc-0:1.21.13-4.el9_4.noarch",
                "product": {
                  "name": "golang-misc-0:1.21.13-4.el9_4.noarch",
                  "product_id": "golang-misc-0:1.21.13-4.el9_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-misc@1.21.13-4.el9_4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-src-0:1.21.13-4.el9_4.noarch",
                "product": {
                  "name": "golang-src-0:1.21.13-4.el9_4.noarch",
                  "product_id": "golang-src-0:1.21.13-4.el9_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-src@1.21.13-4.el9_4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-tests-0:1.21.13-4.el9_4.noarch",
                "product": {
                  "name": "golang-tests-0:1.21.13-4.el9_4.noarch",
                  "product_id": "golang-tests-0:1.21.13-4.el9_4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-tests@1.21.13-4.el9_4?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.aarch64"
        },
        "product_reference": "go-toolset-0:1.21.13-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.ppc64le"
        },
        "product_reference": "go-toolset-0:1.21.13-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.s390x"
        },
        "product_reference": "go-toolset-0:1.21.13-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.x86_64"
        },
        "product_reference": "go-toolset-0:1.21.13-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.aarch64"
        },
        "product_reference": "golang-0:1.21.13-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.ppc64le"
        },
        "product_reference": "golang-0:1.21.13-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.s390x"
        },
        "product_reference": "golang-0:1.21.13-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-4.el9_4.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.src"
        },
        "product_reference": "golang-0:1.21.13-4.el9_4.src",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.x86_64"
        },
        "product_reference": "golang-0:1.21.13-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.aarch64"
        },
        "product_reference": "golang-bin-0:1.21.13-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.ppc64le"
        },
        "product_reference": "golang-bin-0:1.21.13-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.s390x"
        },
        "product_reference": "golang-bin-0:1.21.13-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.x86_64"
        },
        "product_reference": "golang-bin-0:1.21.13-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-docs-0:1.21.13-4.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-docs-0:1.21.13-4.el9_4.noarch"
        },
        "product_reference": "golang-docs-0:1.21.13-4.el9_4.noarch",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-misc-0:1.21.13-4.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-misc-0:1.21.13-4.el9_4.noarch"
        },
        "product_reference": "golang-misc-0:1.21.13-4.el9_4.noarch",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-src-0:1.21.13-4.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-src-0:1.21.13-4.el9_4.noarch"
        },
        "product_reference": "golang-src-0:1.21.13-4.el9_4.noarch",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-tests-0:1.21.13-4.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:golang-tests-0:1.21.13-4.el9_4.noarch"
        },
        "product_reference": "golang-tests-0:1.21.13-4.el9_4.noarch",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.src",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-docs-0:1.21.13-4.el9_4.noarch",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-misc-0:1.21.13-4.el9_4.noarch",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-src-0:1.21.13-4.el9_4.noarch",
          "AppStream-9.4.0.Z.MAIN.EUS:golang-tests-0:1.21.13-4.el9_4.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-02T18:24:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-docs-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-misc-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-src-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-tests-0:1.21.13-4.el9_4.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7550"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-docs-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-misc-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-src-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-tests-0:1.21.13-4.el9_4.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:go-toolset-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-bin-0:1.21.13-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-docs-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-misc-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-src-0:1.21.13-4.el9_4.noarch",
            "AppStream-9.4.0.Z.MAIN.EUS:golang-tests-0:1.21.13-4.el9_4.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for grafana is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\n* dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:8327",
        "url": "https://access.redhat.com/errata/RHSA-2024:8327"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "external",
        "summary": "2318052",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318052"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8327.json"
      }
    ],
    "title": "Red Hat Security Advisory: grafana security update",
    "tracking": {
      "current_release_date": "2025-07-14T20:50:14+00:00",
      "generator": {
        "date": "2025-07-14T20:50:14+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.3"
        }
      },
      "id": "RHSA-2024:8327",
      "initial_release_date": "2024-10-22T15:15:27+00:00",
      "revision_history": [
        {
          "date": "2024-10-22T15:15:27+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-22T15:15:27+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-14T20:50:14+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-20.el8_10.src",
                "product": {
                  "name": "grafana-0:9.2.10-20.el8_10.src",
                  "product_id": "grafana-0:9.2.10-20.el8_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-20.el8_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-20.el8_10.aarch64",
                "product": {
                  "name": "grafana-0:9.2.10-20.el8_10.aarch64",
                  "product_id": "grafana-0:9.2.10-20.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-20.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-20.el8_10.aarch64",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-20.el8_10.aarch64",
                  "product_id": "grafana-selinux-0:9.2.10-20.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-20.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
                  "product_id": "grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-20.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
                  "product_id": "grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-20.el8_10?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-20.el8_10.ppc64le",
                "product": {
                  "name": "grafana-0:9.2.10-20.el8_10.ppc64le",
                  "product_id": "grafana-0:9.2.10-20.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-20.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
                  "product_id": "grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-20.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
                  "product_id": "grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-20.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
                  "product_id": "grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-20.el8_10?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-20.el8_10.x86_64",
                "product": {
                  "name": "grafana-0:9.2.10-20.el8_10.x86_64",
                  "product_id": "grafana-0:9.2.10-20.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-20.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-20.el8_10.x86_64",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-20.el8_10.x86_64",
                  "product_id": "grafana-selinux-0:9.2.10-20.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-20.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
                  "product_id": "grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-20.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
                  "product_id": "grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-20.el8_10?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-20.el8_10.s390x",
                "product": {
                  "name": "grafana-0:9.2.10-20.el8_10.s390x",
                  "product_id": "grafana-0:9.2.10-20.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-20.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-20.el8_10.s390x",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-20.el8_10.s390x",
                  "product_id": "grafana-selinux-0:9.2.10-20.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-20.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-20.el8_10.s390x",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-20.el8_10.s390x",
                  "product_id": "grafana-debugsource-0:9.2.10-20.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-20.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
                  "product_id": "grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-20.el8_10?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-20.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64"
        },
        "product_reference": "grafana-0:9.2.10-20.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-20.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le"
        },
        "product_reference": "grafana-0:9.2.10-20.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-20.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x"
        },
        "product_reference": "grafana-0:9.2.10-20.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-20.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src"
        },
        "product_reference": "grafana-0:9.2.10-20.el8_10.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-20.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64"
        },
        "product_reference": "grafana-0:9.2.10-20.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-20.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-20.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-20.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-20.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-20.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-20.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-20.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-20.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-20.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64"
        },
        "product_reference": "grafana-selinux-0:9.2.10-20.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-20.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le"
        },
        "product_reference": "grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-20.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x"
        },
        "product_reference": "grafana-selinux-0:9.2.10-20.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-20.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
        },
        "product_reference": "grafana-selinux-0:9.2.10-20.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-22T15:15:27+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8327"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    },
    {
      "cve": "CVE-2024-47875",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2024-10-11T15:20:07.304345+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2318052"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: nesting-based mutation XSS vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "RHBZ#2318052",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318052"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47875",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47875",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098",
          "url": "https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f",
          "url": "https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a",
          "url": "https://github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf"
        }
      ],
      "release_date": "2024-10-11T15:15:05.860000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-22T15:15:27+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8327"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-20.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dompurify: nesting-based mutation XSS vulnerability"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for grafana is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\n* dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:8678",
        "url": "https://access.redhat.com/errata/RHSA-2024:8678"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "external",
        "summary": "2318052",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318052"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8678.json"
      }
    ],
    "title": "Red Hat Security Advisory: grafana security update",
    "tracking": {
      "current_release_date": "2025-07-14T20:51:13+00:00",
      "generator": {
        "date": "2025-07-14T20:51:13+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.3"
        }
      },
      "id": "RHSA-2024:8678",
      "initial_release_date": "2024-10-30T19:42:46+00:00",
      "revision_history": [
        {
          "date": "2024-10-30T19:42:46+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-30T19:42:46+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-14T20:51:13+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.4.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-19.el9_4.src",
                "product": {
                  "name": "grafana-0:9.2.10-19.el9_4.src",
                  "product_id": "grafana-0:9.2.10-19.el9_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-19.el9_4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-19.el9_4.aarch64",
                "product": {
                  "name": "grafana-0:9.2.10-19.el9_4.aarch64",
                  "product_id": "grafana-0:9.2.10-19.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-19.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-19.el9_4.aarch64",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-19.el9_4.aarch64",
                  "product_id": "grafana-selinux-0:9.2.10-19.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-19.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
                  "product_id": "grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-19.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
                  "product_id": "grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-19.el9_4?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-19.el9_4.ppc64le",
                "product": {
                  "name": "grafana-0:9.2.10-19.el9_4.ppc64le",
                  "product_id": "grafana-0:9.2.10-19.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-19.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
                  "product_id": "grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-19.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
                  "product_id": "grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-19.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
                  "product_id": "grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-19.el9_4?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-19.el9_4.x86_64",
                "product": {
                  "name": "grafana-0:9.2.10-19.el9_4.x86_64",
                  "product_id": "grafana-0:9.2.10-19.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-19.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-19.el9_4.x86_64",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-19.el9_4.x86_64",
                  "product_id": "grafana-selinux-0:9.2.10-19.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-19.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
                  "product_id": "grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-19.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
                  "product_id": "grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-19.el9_4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:9.2.10-19.el9_4.s390x",
                "product": {
                  "name": "grafana-0:9.2.10-19.el9_4.s390x",
                  "product_id": "grafana-0:9.2.10-19.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@9.2.10-19.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:9.2.10-19.el9_4.s390x",
                "product": {
                  "name": "grafana-selinux-0:9.2.10-19.el9_4.s390x",
                  "product_id": "grafana-selinux-0:9.2.10-19.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-19.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:9.2.10-19.el9_4.s390x",
                "product": {
                  "name": "grafana-debugsource-0:9.2.10-19.el9_4.s390x",
                  "product_id": "grafana-debugsource-0:9.2.10-19.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-19.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
                "product": {
                  "name": "grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
                  "product_id": "grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-19.el9_4?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-19.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64"
        },
        "product_reference": "grafana-0:9.2.10-19.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-19.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le"
        },
        "product_reference": "grafana-0:9.2.10-19.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-19.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x"
        },
        "product_reference": "grafana-0:9.2.10-19.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-19.el9_4.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src"
        },
        "product_reference": "grafana-0:9.2.10-19.el9_4.src",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:9.2.10-19.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64"
        },
        "product_reference": "grafana-0:9.2.10-19.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-19.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-19.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:9.2.10-19.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64"
        },
        "product_reference": "grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-19.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-19.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-19.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-19.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:9.2.10-19.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64"
        },
        "product_reference": "grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-19.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64"
        },
        "product_reference": "grafana-selinux-0:9.2.10-19.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-19.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le"
        },
        "product_reference": "grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-19.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x"
        },
        "product_reference": "grafana-selinux-0:9.2.10-19.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:9.2.10-19.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
        },
        "product_reference": "grafana-selinux-0:9.2.10-19.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-30T19:42:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8678"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    },
    {
      "cve": "CVE-2024-47875",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2024-10-11T15:20:07.304345+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2318052"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: nesting-based mutation XSS vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
          "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "RHBZ#2318052",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318052"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47875",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47875",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47875"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098",
          "url": "https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f",
          "url": "https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a",
          "url": "https://github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf"
        }
      ],
      "release_date": "2024-10-11T15:15:05.860000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-30T19:42:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8678"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.src",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-19.el9_4.x86_64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.aarch64",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.ppc64le",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.s390x",
            "AppStream-9.4.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-19.el9_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dompurify: nesting-based mutation XSS vulnerability"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for git-lfs is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.\n\nSecurity Fix(es):\n\n* golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)\n\n* golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)\n\n* golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)\n\n* golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)\n\n* net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:7256",
        "url": "https://access.redhat.com/errata/RHSA-2025:7256"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2237777",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2237777"
      },
      {
        "category": "external",
        "summary": "2237778",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2237778"
      },
      {
        "category": "external",
        "summary": "2279814",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2279814"
      },
      {
        "category": "external",
        "summary": "2292787",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2292787"
      },
      {
        "category": "external",
        "summary": "2295310",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295310"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7256.json"
      }
    ],
    "title": "Red Hat Security Advisory: git-lfs security update",
    "tracking": {
      "current_release_date": "2025-07-17T14:57:28+00:00",
      "generator": {
        "date": "2025-07-17T14:57:28+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.3"
        }
      },
      "id": "RHSA-2025:7256",
      "initial_release_date": "2025-05-13T08:49:39+00:00",
      "revision_history": [
        {
          "date": "2025-05-13T08:49:39+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-05-13T08:49:39+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-17T14:57:28+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.6.0.GA",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-lfs-0:3.6.1-1.el9.src",
                "product": {
                  "name": "git-lfs-0:3.6.1-1.el9.src",
                  "product_id": "git-lfs-0:3.6.1-1.el9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/git-lfs@3.6.1-1.el9?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-lfs-0:3.6.1-1.el9.aarch64",
                "product": {
                  "name": "git-lfs-0:3.6.1-1.el9.aarch64",
                  "product_id": "git-lfs-0:3.6.1-1.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/git-lfs@3.6.1-1.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
                "product": {
                  "name": "git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
                  "product_id": "git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/git-lfs-debugsource@3.6.1-1.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
                "product": {
                  "name": "git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
                  "product_id": "git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/git-lfs-debuginfo@3.6.1-1.el9?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-lfs-0:3.6.1-1.el9.ppc64le",
                "product": {
                  "name": "git-lfs-0:3.6.1-1.el9.ppc64le",
                  "product_id": "git-lfs-0:3.6.1-1.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/git-lfs@3.6.1-1.el9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
                "product": {
                  "name": "git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
                  "product_id": "git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/git-lfs-debugsource@3.6.1-1.el9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
                "product": {
                  "name": "git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
                  "product_id": "git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/git-lfs-debuginfo@3.6.1-1.el9?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-lfs-0:3.6.1-1.el9.x86_64",
                "product": {
                  "name": "git-lfs-0:3.6.1-1.el9.x86_64",
                  "product_id": "git-lfs-0:3.6.1-1.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/git-lfs@3.6.1-1.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-lfs-debugsource-0:3.6.1-1.el9.x86_64",
                "product": {
                  "name": "git-lfs-debugsource-0:3.6.1-1.el9.x86_64",
                  "product_id": "git-lfs-debugsource-0:3.6.1-1.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/git-lfs-debugsource@3.6.1-1.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
                "product": {
                  "name": "git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
                  "product_id": "git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/git-lfs-debuginfo@3.6.1-1.el9?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-lfs-0:3.6.1-1.el9.s390x",
                "product": {
                  "name": "git-lfs-0:3.6.1-1.el9.s390x",
                  "product_id": "git-lfs-0:3.6.1-1.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/git-lfs@3.6.1-1.el9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-lfs-debugsource-0:3.6.1-1.el9.s390x",
                "product": {
                  "name": "git-lfs-debugsource-0:3.6.1-1.el9.s390x",
                  "product_id": "git-lfs-debugsource-0:3.6.1-1.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/git-lfs-debugsource@3.6.1-1.el9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
                "product": {
                  "name": "git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
                  "product_id": "git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/git-lfs-debuginfo@3.6.1-1.el9?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-0:3.6.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64"
        },
        "product_reference": "git-lfs-0:3.6.1-1.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-0:3.6.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le"
        },
        "product_reference": "git-lfs-0:3.6.1-1.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-0:3.6.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x"
        },
        "product_reference": "git-lfs-0:3.6.1-1.el9.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-0:3.6.1-1.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src"
        },
        "product_reference": "git-lfs-0:3.6.1-1.el9.src",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-0:3.6.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64"
        },
        "product_reference": "git-lfs-0:3.6.1-1.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-debuginfo-0:3.6.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64"
        },
        "product_reference": "git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le"
        },
        "product_reference": "git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-debuginfo-0:3.6.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x"
        },
        "product_reference": "git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-debuginfo-0:3.6.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64"
        },
        "product_reference": "git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-debugsource-0:3.6.1-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64"
        },
        "product_reference": "git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-debugsource-0:3.6.1-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le"
        },
        "product_reference": "git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-debugsource-0:3.6.1-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x"
        },
        "product_reference": "git-lfs-debugsource-0:3.6.1-1.el9.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-debugsource-0:3.6.1-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
        },
        "product_reference": "git-lfs-debugsource-0:3.6.1-1.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Martin Seemann"
          ]
        }
      ],
      "cve": "CVE-2023-39321",
      "discovery_date": "2023-09-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2237777"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Golang. Processing an incomplete post-handshake message for a QUIC connection caused a panic.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: crypto/tls: panic when processing post-handshake message on QUIC connections",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-39321"
        },
        {
          "category": "external",
          "summary": "RHBZ#2237777",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2237777"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-39321",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-39321"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-39321",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39321"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/523039",
          "url": "https://go.dev/cl/523039"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/62266",
          "url": "https://go.dev/issue/62266"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ",
          "url": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ"
        },
        {
          "category": "external",
          "summary": "https://vuln.go.dev/ID/GO-2023-2044.json",
          "url": "https://vuln.go.dev/ID/GO-2023-2044.json"
        }
      ],
      "release_date": "2023-09-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:49:39+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7256"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: crypto/tls: panic when processing post-handshake message on QUIC connections"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Marten Seemann"
          ]
        }
      ],
      "cve": "CVE-2023-39322",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2023-09-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2237778"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Golang. QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With the fix, connections now consistently reject messages larger than 65KiB in size.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: crypto/tls: lack of a limit on buffered post-handshake",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-39322"
        },
        {
          "category": "external",
          "summary": "RHBZ#2237778",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2237778"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-39322",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-39322"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-39322",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39322"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/523039",
          "url": "https://go.dev/cl/523039"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/62266",
          "url": "https://go.dev/issue/62266"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ",
          "url": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ"
        },
        {
          "category": "external",
          "summary": "https://vuln.go.dev/ID/GO-2023-2045.json",
          "url": "https://vuln.go.dev/ID/GO-2023-2045.json"
        }
      ],
      "release_date": "2023-09-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:49:39+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7256"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: crypto/tls: lack of a limit on buffered post-handshake"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:49:39+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7256"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    },
    {
      "cve": "CVE-2024-24788",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2024-05-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2279814"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the net package of the Go stdlib. When a malformed DNS message is received as a response to a query, the Lookup functions within the net package can get stuck in an infinite loop. This issue can lead to resource exhaustion and denial of service (DoS) conditions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net: malformed DNS message can cause infinite loop",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nThe platform enforces hardening guidelines to ensure the most restrictive setting needed for operational requirements. Event logs are collected and processed for centralization, correlation, analysis, monitoring, reporting, alerting, and retention. This process ensures that audit logs are generated for specific events involving sensitive information, enabling capabilities like excessive CPU usage, long execution times, or processes consuming abnormal amounts of memory. Static code analysis and peer code review techniques are used to execute robust input validation and error-handling mechanisms to ensure all user inputs are thoroughly validated, preventing infinite loops caused by malformed or unexpected input, such as unbounded user input or unexpected null values that cause loops to never terminate. In the event of successful exploitation, process isolation limits the effect of an infinite loop to a single process rather than allowing it to consume all system resources.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-24788"
        },
        {
          "category": "external",
          "summary": "RHBZ#2279814",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2279814"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-24788",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-24788"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24788",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24788"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-2824",
          "url": "https://pkg.go.dev/vuln/GO-2024-2824"
        }
      ],
      "release_date": "2024-05-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:49:39+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7256"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: net: malformed DNS message can cause infinite loop"
    },
    {
      "cve": "CVE-2024-24790",
      "cwe": {
        "id": "CWE-115",
        "name": "Misinterpretation of Input"
      },
      "discovery_date": "2024-06-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2292787"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go language standard library net/netip. The method Is*() (IsPrivate(), IsPublic(), etc) doesn\u0027t behave properly when working with IPv6 mapped to IPv4 addresses. The unexpected behavior can lead to integrity and confidentiality issues, specifically when these methods are used to control access to resources or data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This CVE has been marked as moderate as for our products a network-based attack vector is simply impossible when it comes to golang code,apart from that as per CVE flaw analysis reported by golang, this only affects integrity and confidentiality and has no effect on availability, hence CVSS has been marked as such.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-115: Misinterpretation of Input vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nControls such as input validation and error handling mitigate input misinterpretation risks by enforcing strict validation rules and secure error management. Error handling ensures inputs are validated against predefined formats, preventing malformed data from being misinterpreted. Techniques like strong typing, allow listing, and proper encoding reduce the likelihood of injection attacks and unintended code execution. Input validation also ensures that errors do not expose sensitive system details or cause unpredictable behavior. Secure error handling prevents information leakage through detailed error messages while preserving system stability under malformed input conditions. Together, these controls reduce the attack surface by maintaining consistent input processing and preventing exploitable system states, strengthening the overall security posture.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-24790"
        },
        {
          "category": "external",
          "summary": "RHBZ#2292787",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2292787"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-24790",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-24790"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24790",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24790"
        }
      ],
      "release_date": "2024-06-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:49:39+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7256"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses"
    },
    {
      "cve": "CVE-2024-24791",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2024-07-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2295310"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go. The net/http module mishandles specific server responses from HTTP/1.1 client requests. This issue may render a connection invalid and cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: Denial of service due to improper 100-continue handling in net/http",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An attacker would need to control a malicious server and induce a client to connect to it, requiring some amount of preparation outside of the attacker\u0027s control. This reduces the severity score of this flaw to Moderate.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-20: Improper Input Validation vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nRed Hat enforces the principle of least functionality, ensuring that only essential features, services, and ports are enabled. This minimizes the number of components that could be affected by input validation vulnerabilities. Security testing and evaluation standards are implemented within the environment to rigorously test input validation mechanisms during the development lifecycle, while static code analysis identifies potential input validation vulnerabilities by default. Process isolation ensures that processes handling potentially malicious or unvalidated inputs run in isolated environments by separating execution domains for each process. Malicious code protections, such as IPS/IDS and antimalware solutions, help detect and mitigate malicious payloads stemming from input validation vulnerabilities. Finally, robust input validation and error-handling mechanisms ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks further.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
          "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
          "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "RHBZ#2295310",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295310"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-24791",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24791",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/591255",
          "url": "https://go.dev/cl/591255"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/67555",
          "url": "https://go.dev/issue/67555"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ",
          "url": "https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ"
        }
      ],
      "release_date": "2024-07-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:49:39+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7256"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.src",
            "AppStream-9.6.0.GA:git-lfs-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debuginfo-0:3.6.1-1.el9.x86_64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.aarch64",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.ppc64le",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.s390x",
            "AppStream-9.6.0.GA:git-lfs-debugsource-0:3.6.1-1.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: Denial of service due to improper 100-continue handling in net/http"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for grafana-pcp is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.\n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:9551",
        "url": "https://access.redhat.com/errata/RHSA-2024:9551"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9551.json"
      }
    ],
    "title": "Red Hat Security Advisory: grafana-pcp security update",
    "tracking": {
      "current_release_date": "2025-07-10T01:49:28+00:00",
      "generator": {
        "date": "2025-07-10T01:49:28+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.3"
        }
      },
      "id": "RHSA-2024:9551",
      "initial_release_date": "2024-11-13T14:54:47+00:00",
      "revision_history": [
        {
          "date": "2024-11-13T14:54:47+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-11-13T14:54:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-10T01:49:28+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)",
                  "product_id": "AppStream-9.4.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus:9.4::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-4.el9_4.src",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-4.el9_4.src",
                  "product_id": "grafana-pcp-0:5.1.1-4.el9_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-4.el9_4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-4.el9_4.aarch64",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-4.el9_4.aarch64",
                  "product_id": "grafana-pcp-0:5.1.1-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-4.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-4.el9_4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-4.el9_4?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
                  "product_id": "grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-4.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-4.el9_4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-4.el9_4?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-4.el9_4.x86_64",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-4.el9_4.x86_64",
                  "product_id": "grafana-pcp-0:5.1.1-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-4.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-4.el9_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-4.el9_4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-4.el9_4.s390x",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-4.el9_4.s390x",
                  "product_id": "grafana-pcp-0:5.1.1-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-4.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-4.el9_4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-4.el9_4?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.aarch64"
        },
        "product_reference": "grafana-pcp-0:5.1.1-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.ppc64le"
        },
        "product_reference": "grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.s390x"
        },
        "product_reference": "grafana-pcp-0:5.1.1-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-4.el9_4.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.src"
        },
        "product_reference": "grafana-pcp-0:5.1.1-4.el9_4.src",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.x86_64"
        },
        "product_reference": "grafana-pcp-0:5.1.1-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.s390x",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.src",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.x86_64",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
          "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-13T14:54:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.src",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:9551"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.src",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.src",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debuginfo-0:5.1.1-4.el9_4.x86_64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.aarch64",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.ppc64le",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.s390x",
            "AppStream-9.4.0.Z.EUS:grafana-pcp-debugsource-0:5.1.1-4.el9_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:7502",
        "url": "https://access.redhat.com/errata/RHSA-2024:7502"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7502.json"
      }
    ],
    "title": "Red Hat Security Advisory: go-toolset:rhel8 security update",
    "tracking": {
      "current_release_date": "2025-07-10T01:48:16+00:00",
      "generator": {
        "date": "2025-07-10T01:48:16+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.3"
        }
      },
      "id": "RHSA-2024:7502",
      "initial_release_date": "2024-10-02T11:50:23+00:00",
      "revision_history": [
        {
          "date": "2024-10-02T11:50:23+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-02T11:50:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-10T01:48:16+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset:rhel8:8100020241001112709:a3795dee",
                "product": {
                  "name": "go-toolset:rhel8:8100020241001112709:a3795dee",
                  "product_id": "go-toolset:rhel8:8100020241001112709:a3795dee",
                  "product_identification_helper": {
                    "purl": "pkg:rpmmod/redhat/go-toolset@rhel8:8100020241001112709:a3795dee"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                "product": {
                  "name": "golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_id": "golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-docs@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                "product": {
                  "name": "golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_id": "golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-misc@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                "product": {
                  "name": "golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_id": "golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-src@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                "product": {
                  "name": "golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_id": "golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-tests@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
                "product": {
                  "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
                  "product_id": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
                "product": {
                  "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
                  "product_id": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-1.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
                "product": {
                  "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
                  "product_id": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                "product": {
                  "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_id": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                "product": {
                  "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_id": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debuginfo@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                "product": {
                  "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_id": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debugsource@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
                "product": {
                  "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_id": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-1.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                "product": {
                  "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                  "product_id": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                "product": {
                  "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                  "product_id": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                "product": {
                  "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_id": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                "product": {
                  "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_id": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debuginfo@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                "product": {
                  "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_id": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debugsource@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                "product": {
                  "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_id": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-1.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                "product": {
                  "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                  "product_id": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                "product": {
                  "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                  "product_id": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                "product": {
                  "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_id": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                "product": {
                  "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_id": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debuginfo@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                "product": {
                  "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_id": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/delve-debugsource@1.21.2-4.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
                "product": {
                  "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_id": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-1.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                "product": {
                  "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                  "product_id": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                "product": {
                  "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                  "product_id": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
                "product": {
                  "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
                  "product_id": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.21.13-1.module%2Bel8.10.0%2B22329%2B6cd5c9c6?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                "product": {
                  "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                  "product_id": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                "product": {
                  "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                  "product_id": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.21.13-3.module%2Bel8.10.0%2B22345%2Bacdd8d0e?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
        },
        "product_reference": "go-toolset:rhel8:8100020241001112709:a3795dee",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64"
        },
        "product_reference": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le"
        },
        "product_reference": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src"
        },
        "product_reference": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64"
        },
        "product_reference": "delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64"
        },
        "product_reference": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le"
        },
        "product_reference": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64"
        },
        "product_reference": "delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64"
        },
        "product_reference": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le"
        },
        "product_reference": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64"
        },
        "product_reference": "delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64"
        },
        "product_reference": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le"
        },
        "product_reference": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x"
        },
        "product_reference": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src"
        },
        "product_reference": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64"
        },
        "product_reference": "go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64"
        },
        "product_reference": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le"
        },
        "product_reference": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x"
        },
        "product_reference": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src"
        },
        "product_reference": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64"
        },
        "product_reference": "golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64"
        },
        "product_reference": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le"
        },
        "product_reference": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x"
        },
        "product_reference": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64 as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64"
        },
        "product_reference": "golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
        },
        "product_reference": "golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
        },
        "product_reference": "golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
        },
        "product_reference": "golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch as a component of go-toolset:rhel8:8100020241001112709:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
        },
        "product_reference": "golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
          "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-02T11:50:23+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7502"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debuginfo-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:delve-debugsource-0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:go-toolset-0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.src",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-bin-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-docs-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-misc-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-src-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020241001112709:a3795dee:golang-tests-0:1.21.13-3.module+el8.10.0+22345+acdd8d0e.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for grafana-pcp is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.\n\nSecurity Fix(es):\n\n* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:8847",
        "url": "https://access.redhat.com/errata/RHSA-2024:8847"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2315719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8847.json"
      }
    ],
    "title": "Red Hat Security Advisory: grafana-pcp security update",
    "tracking": {
      "current_release_date": "2025-07-10T01:49:14+00:00",
      "generator": {
        "date": "2025-07-10T01:49:14+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.3"
        }
      },
      "id": "RHSA-2024:8847",
      "initial_release_date": "2024-11-05T03:58:20+00:00",
      "revision_history": [
        {
          "date": "2024-11-05T03:58:20+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-11-05T03:58:20+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-10T01:49:14+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-9.el8_10.src",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-9.el8_10.src",
                  "product_id": "grafana-pcp-0:5.1.1-9.el8_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-9.el8_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-9.el8_10.aarch64",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-9.el8_10.aarch64",
                  "product_id": "grafana-pcp-0:5.1.1-9.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-9.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-9.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-9.el8_10?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
                  "product_id": "grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-9.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-9.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-9.el8_10?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-9.el8_10.x86_64",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-9.el8_10.x86_64",
                  "product_id": "grafana-pcp-0:5.1.1-9.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-9.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-9.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-9.el8_10?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-pcp-0:5.1.1-9.el8_10.s390x",
                "product": {
                  "name": "grafana-pcp-0:5.1.1-9.el8_10.s390x",
                  "product_id": "grafana-pcp-0:5.1.1-9.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-9.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
                "product": {
                  "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
                  "product_id": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-9.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
                "product": {
                  "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
                  "product_id": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-9.el8_10?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-9.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.aarch64"
        },
        "product_reference": "grafana-pcp-0:5.1.1-9.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-9.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.ppc64le"
        },
        "product_reference": "grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-9.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.s390x"
        },
        "product_reference": "grafana-pcp-0:5.1.1-9.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-9.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.src"
        },
        "product_reference": "grafana-pcp-0:5.1.1-9.el8_10.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-0:5.1.1-9.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.x86_64"
        },
        "product_reference": "grafana-pcp-0:5.1.1-9.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64"
        },
        "product_reference": "grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64"
        },
        "product_reference": "grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-05T03:58:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:8847"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-9.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-9.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for govulncheck-vulndb",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for govulncheck-vulndb fixes the following issues:\n\nUpdate to version 0.0.20241030T212825 2024-10-30T21:28:25Z ( jsc#PED-11136 )\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm\n  * GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr\n  * GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c\n  * GO-2024-3228 GHSA-wcx9-ccpj-hx3c\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3207 GHSA-p5wf-cmr4-xrwr\n  * GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6\n  * GO-2024-3210 CVE-2024-8901\n  * GO-2024-3211 CVE-2024-50312\n  * GO-2024-3212 GHSA-rjfv-pjvx-mjgv\n  * GO-2024-3213 CVE-2024-49380\n  * GO-2024-3214 CVE-2024-49381\n  * GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7\n  * GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv\n  * GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc\n  * GO-2024-3219 GHSA-7h65-4p22-39j6\n  * GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4\n  * GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc\n  * GO-2024-3222 GHSA-x7xj-jvwp-97rv\n  * GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v\n  * GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3203 CVE-2024-9486\n  * GO-2024-3204 CVE-2024-9594\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc\n  * GO-2024-3199 GHSA-vv6c-69r6-chg9\n  * GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj\n  * GO-2024-3201 CVE-2023-22644\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4\n  * GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3\n  * GO-2024-3163 CVE-2024-47182\n  * GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52\n  * GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h\n  * GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc\n  * GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4\n  * GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8\n  * GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4\n  * GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x\n  * GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq\n  * GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr\n  * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787\n  * GO-2024-3182 GHSA-wpr2-j6gr-pjw9\n  * GO-2024-3184 CVE-2024-36814 GHSA-9cp9-8gw2-8v7m\n  * GO-2024-3185 CVE-2024-47832\n  * GO-2024-3186 CVE-2024-9675 GHSA-586p-749j-fhwp\n  * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2\n  * GO-2024-3190 CVE-2024-47067 GHSA-8pph-gfhp-w226\n  * GO-2024-3191 CVE-2024-9180 GHSA-rr8j-7w34-xp5j",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2024-3911,SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-3911,SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-3911,openSUSE-SLE-15.5-2024-3911,openSUSE-SLE-15.6-2024-3911",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_3911-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2024:3911-1",
        "url": "https://www.suse.com/support/update/announcement/2024/suse-su-20243911-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2024:3911-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-November/019776.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-45157 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-45157/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-22644 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-22644/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-32197 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-32197/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-10214 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-10214/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-10241 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-10241/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-22030 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-22030/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-22036 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-22036/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-33662 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-33662/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-36814 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-36814/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-38365 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-38365/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-39223 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-39223/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47003 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47003/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47067 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47067/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47182 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47182/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47534 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47534/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47616 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47616/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47825 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47825/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47827 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47827/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47832 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47832/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47877 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47877/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-48909 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-48909/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-48921 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-48921/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-49380 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-49380/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-49381 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-49381/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-49753 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-49753/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-49757 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-49757/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-50312 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-50312/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-7558 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-7558/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-7594 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-7594/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8037 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8037/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8038 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8038/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8901 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8901/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8975 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8975/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8996 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8996/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9180 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9180/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9264 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9264/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9312 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9312/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9313 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9313/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9341 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9341/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9355 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9355/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9407 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9407/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9486 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9486/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9594 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9594/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9675 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9675/"
      }
    ],
    "title": "Security update for govulncheck-vulndb",
    "tracking": {
      "current_release_date": "2024-11-05T07:45:02Z",
      "generator": {
        "date": "2024-11-05T07:45:02Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2024:3911-1",
      "initial_release_date": "2024-11-05T07:45:02Z",
      "revision_history": [
        {
          "date": "2024-11-05T07:45:02Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
                  "product_id": "govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Package Hub 15 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Package Hub 15 SP5",
                  "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:packagehub:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
                  "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:packagehub:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.5",
                "product": {
                  "name": "openSUSE Leap 15.5",
                  "product_id": "openSUSE Leap 15.5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.6",
                "product": {
                  "name": "openSUSE Leap 15.6",
                  "product_id": "openSUSE Leap 15.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP5",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        },
        "product_reference": "govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        },
        "product_reference": "govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of openSUSE Leap 15.5",
          "product_id": "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        },
        "product_reference": "govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        },
        "product_reference": "govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-45157",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-45157"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability has been identified in the way that Rancher stores vSphere\u0027s CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-45157",
          "url": "https://www.suse.com/security/cve/CVE-2022-45157"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231677 for CVE-2022-45157",
          "url": "https://bugzilla.suse.com/1231677"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2022-45157"
    },
    {
      "cve": "CVE-2023-22644",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-22644"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-22644",
          "url": "https://www.suse.com/security/cve/CVE-2023-22644"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1207199 for CVE-2023-22644",
          "url": "https://bugzilla.suse.com/1207199"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209434 for CVE-2023-22644",
          "url": "https://bugzilla.suse.com/1209434"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2023-22644"
    },
    {
      "cve": "CVE-2023-32197",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-32197"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-32197",
          "url": "https://www.suse.com/security/cve/CVE-2023-32197"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222643 for CVE-2023-32197",
          "url": "https://bugzilla.suse.com/1222643"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222681 for CVE-2023-32197",
          "url": "https://bugzilla.suse.com/1222681"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-32197"
    },
    {
      "cve": "CVE-2024-10214",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-10214"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 9.11.X \u003c= 9.11.1, 9.5.x \u003c= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-10214",
          "url": "https://www.suse.com/security/cve/CVE-2024-10214"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "low"
        }
      ],
      "title": "CVE-2024-10214"
    },
    {
      "cve": "CVE-2024-10241",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-10241"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 9.5.x \u003c= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get  private channel names by using cmd+K/ctrl+K.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-10241",
          "url": "https://www.suse.com/security/cve/CVE-2024-10241"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-10241"
    },
    {
      "cve": "CVE-2024-22030",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-22030"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability has been identified within Rancher that can be exploited\n in narrow circumstances through a man-in-the-middle (MITM) attack. An \nattacker would need to have control of an expired domain or execute a \nDNS spoofing/hijacking attack against the domain to exploit this \nvulnerability. The targeted domain is the one used as the Rancher URL.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-22030",
          "url": "https://www.suse.com/security/cve/CVE-2024-22030"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1219982 for CVE-2024-22030",
          "url": "https://bugzilla.suse.com/1219982"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-22030"
    },
    {
      "cve": "CVE-2024-22036",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-22036"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-22036",
          "url": "https://www.suse.com/security/cve/CVE-2024-22036"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231280 for CVE-2024-22036",
          "url": "https://bugzilla.suse.com/1231280"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-22036"
    },
    {
      "cve": "CVE-2024-33662",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-33662"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-33662",
          "url": "https://www.suse.com/security/cve/CVE-2024-33662"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-33662"
    },
    {
      "cve": "CVE-2024-36814",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-36814"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An arbitrary file read vulnerability in Adguard Home before v0.107.52 allows authenticated attackers to access arbitrary files as root on the underlying Operating System via placing a crafted file into a readable directory.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-36814",
          "url": "https://www.suse.com/security/cve/CVE-2024-36814"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-36814"
    },
    {
      "cve": "CVE-2024-38365",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-38365"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core\u0027s \"FindAndDelete()\" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). This consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn\u0027t return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a \"standard\" Bitcoin transaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block. `removeOpcodeByData(script []byte, dataToRemove []byte)` removes any data pushes from `script` that contain `dataToRemove`. However, `FindAndDelete` only removes exact matches. So for example, with `script = \"\u003cdata\u003e \u003cdata||foo\u003e\"` and `dataToRemove = \"data\"` btcd will remove both data pushes but Bitcoin Core\u0027s `FindAndDelete` only removes the first `\u003cdata\u003e` push. This has been patched in btcd version v0.24.2. Users are advised to upgrade. There are no known workarounds for this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-38365",
          "url": "https://www.suse.com/security/cve/CVE-2024-38365"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-38365"
    },
    {
      "cve": "CVE-2024-39223",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-39223"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-39223",
          "url": "https://www.suse.com/security/cve/CVE-2024-39223"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2024-39223"
    },
    {
      "cve": "CVE-2024-47003",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47003"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 9.11.x \u003c= 9.11.0 and 9.5.x \u003c= 9.5.8 fail to validate that the message of the permalink post is a string,  which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47003",
          "url": "https://www.suse.com/security/cve/CVE-2024-47003"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47003"
    },
    {
      "cve": "CVE-2024-47067",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47067"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. The endpoint /i/:link_name takes in a user-provided value and reflects it back in the response. The endpoint returns an application/xml response, opening it up to HTML tags via XHTML and thus leading to a XSS vulnerability. This vulnerability is fixed in 3.29.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47067",
          "url": "https://www.suse.com/security/cve/CVE-2024-47067"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47067"
    },
    {
      "cve": "CVE-2024-47182",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47182"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches to bcrypt, a more appropriate hash for passwords, in version 8.5.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47182",
          "url": "https://www.suse.com/security/cve/CVE-2024-47182"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-47182"
    },
    {
      "cve": "CVE-2024-47534",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47534"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to \"A\", and to \"B\", and \"B\" delegates to \"C\", then the client should trace the delegations in the order \"A\" then \"B\" then \"C\" but it may incorrectly trace the delegations \"B\"-\u003e\"C\"-\u003e\"A\". This vulnerability is fixed in 2.0.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47534",
          "url": "https://www.suse.com/security/cve/CVE-2024-47534"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-47534"
    },
    {
      "cve": "CVE-2024-47616",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47616"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium application state. Requests to the databroker service API are authorized by the presence of a JSON Web Token (JWT) signed by a key known by all Pomerium services in the same deployment. However, incomplete validation of this JWT meant that some service account access tokens would incorrectly be treated as valid for the purpose of databroker API authorization. Improper access to the databroker API could allow exfiltration of user info, spoofing of user sessions, or tampering with Pomerium routes, policies, and other settings. A Pomerium deployment is susceptible to this issue if all of the following conditions are met, you have issued a service account access token using Pomerium Zero or Pomerium Enterprise, the access token has an explicit expiration date in the future, and the core Pomerium databroker gRPC API is not otherwise secured by network access controls. This vulnerability is fixed in 0.27.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47616",
          "url": "https://www.suse.com/security/cve/CVE-2024-47616"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47616"
    },
    {
      "cve": "CVE-2024-47825",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47825"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if there is a policy rule referencing a more narrow prefix (`CIDRSet` or `toFQDN`) and this narrower policy rule specifies either `enableDefaultDeny: false` or `- toEntities: all`. Note that a rule specifying `toEntities: world` or `toEntities: 0.0.0.0/0` is insufficient, it must be to entity `all`.This issue has been patched in Cilium v1.14.16 and v1.15.10. As this issue only affects policies using `enableDefaultDeny: false` or that set `toEntities` to `all`, some workarounds are available. For users with policies using `enableDefaultDeny: false`, remove this configuration option and explicitly define any allow rules required. For users with egress policies that explicitly specify `toEntities: all`, use `toEntities: world`.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47825",
          "url": "https://www.suse.com/security/cve/CVE-2024-47825"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-47825"
    },
    {
      "cve": "CVE-2024-47827",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47827"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47827",
          "url": "https://www.suse.com/security/cve/CVE-2024-47827"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47827"
    },
    {
      "cve": "CVE-2024-47832",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47832"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers. Users of https://ssoready.com, the public hosted instance of SSOReady, are unaffected. We advise folks who self-host SSOReady to upgrade to 7f92a06 or later. Do so by updating your SSOReady Docker images from sha-... to sha-7f92a06. There are no known workarounds for this vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47832",
          "url": "https://www.suse.com/security/cve/CVE-2024-47832"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2024-47832"
    },
    {
      "cve": "CVE-2024-47877",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47877"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This vulnerability is fixed in 4.0.0. If you\u0027re using the Extractor.FS interface, then upgrading to /v4 will require to implement the new methods that have been added.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47877",
          "url": "https://www.suse.com/security/cve/CVE-2024-47877"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47877"
    },
    {
      "cve": "CVE-2024-48909",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-48909"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-48909",
          "url": "https://www.suse.com/security/cve/CVE-2024-48909"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "low"
        }
      ],
      "title": "CVE-2024-48909"
    },
    {
      "cve": "CVE-2024-48921",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-48921"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. \"disallow-privileged-containers,\" can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. This vulnerability is fixed in 1.13.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-48921",
          "url": "https://www.suse.com/security/cve/CVE-2024-48921"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1232557 for CVE-2024-48921",
          "url": "https://bugzilla.suse.com/1232557"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-48921"
    },
    {
      "cve": "CVE-2024-49380",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-49380"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-49380",
          "url": "https://www.suse.com/security/cve/CVE-2024-49380"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-49380"
    },
    {
      "cve": "CVE-2024-49381",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-49381"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write deletion when a plenti user serves their website. This issue may lead to information loss. Version 0.7.2 fixes the vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-49381",
          "url": "https://www.suse.com/security/cve/CVE-2024-49381"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-49381"
    },
    {
      "cve": "CVE-2024-49753",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-49753"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost (127.0.0.1). The isHostBlocked check, designed to prevent such requests, can be circumvented by creating a DNS record that resolves to 127.0.0.1. This enables actions to send requests to localhost despite the intended security measures. This vulnerability potentially allows unauthorized access to unsecured internal endpoints, which may contain sensitive information or functionalities. Versions 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-49753",
          "url": "https://www.suse.com/security/cve/CVE-2024-49753"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-49753"
    },
    {
      "cve": "CVE-2024-49757",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-49757"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the \"User Registration allowed\" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-49757",
          "url": "https://www.suse.com/security/cve/CVE-2024-49757"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-49757"
    },
    {
      "cve": "CVE-2024-50312",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-50312"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application\u0027s GraphQL implementation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-50312",
          "url": "https://www.suse.com/security/cve/CVE-2024-50312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-50312"
    },
    {
      "cve": "CVE-2024-7558",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-7558"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-7558",
          "url": "https://www.suse.com/security/cve/CVE-2024-7558"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-7558"
    },
    {
      "cve": "CVE-2024-7594",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-7594"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vault\u0027s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault\u0027s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-7594",
          "url": "https://www.suse.com/security/cve/CVE-2024-7594"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-7594"
    },
    {
      "cve": "CVE-2024-8037",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8037"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8037",
          "url": "https://www.suse.com/security/cve/CVE-2024-8037"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-8037"
    },
    {
      "cve": "CVE-2024-8038",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8038"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8038",
          "url": "https://www.suse.com/security/cve/CVE-2024-8038"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-8038"
    },
    {
      "cve": "CVE-2024-8901",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8901"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The  AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master  provides an OIDC authentication mechanism that was integrated into the open source Kubeflow project. The adapter uses JWT for authentication, but lacks proper signer and issuer validation. In deployments of ALB that ignore security best practices, where ALB targets are directly exposed to internet traffic, an actor can provide a JWT signed by an untrusted entity in order to spoof OIDC-federated sessions and successfully bypass authentication.\n\n\n\nThe repository/package has been deprecated, is end of life, and is no longer supported. As a security best practice, ensure that your ELB targets (e.g. EC2 Instances, Fargate Tasks etc.) do not have public IP addresses. Ensure any forked or derivative code validate that the signer  attribute in the JWT match the ARN of the Application Load Balancer that the service is configured to use.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8901",
          "url": "https://www.suse.com/security/cve/CVE-2024-8901"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-8901"
    },
    {
      "cve": "CVE-2024-8975",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8975"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM\nThis issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8975",
          "url": "https://www.suse.com/security/cve/CVE-2024-8975"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-8975"
    },
    {
      "cve": "CVE-2024-8996",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8996"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM\nThis issue affects Agent Flow: before 0.43.2",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8996",
          "url": "https://www.suse.com/security/cve/CVE-2024-8996"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-8996"
    },
    {
      "cve": "CVE-2024-9180",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9180"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A privileged Vault operator with write permissions to the root namespace\u0027s identity endpoint could escalate their own or another user\u0027s privileges to Vault\u0027s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9180",
          "url": "https://www.suse.com/security/cve/CVE-2024-9180"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-9180"
    },
    {
      "cve": "CVE-2024-9264",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9264"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack.  The `duckdb` binary must be present in Grafana\u0027s $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9264",
          "url": "https://www.suse.com/security/cve/CVE-2024-9264"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231844 for CVE-2024-9264",
          "url": "https://bugzilla.suse.com/1231844"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2024-9264"
    },
    {
      "cve": "CVE-2024-9312",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9312"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user\u0027s ID and gain their privileges.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9312",
          "url": "https://www.suse.com/security/cve/CVE-2024-9312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-9312"
    },
    {
      "cve": "CVE-2024-9313",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9313"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9313",
          "url": "https://www.suse.com/security/cve/CVE-2024-9313"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-9313"
    },
    {
      "cve": "CVE-2024-9341",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9341"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9341",
          "url": "https://www.suse.com/security/cve/CVE-2024-9341"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231230 for CVE-2024-9341",
          "url": "https://bugzilla.suse.com/1231230"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9341"
    },
    {
      "cve": "CVE-2024-9355",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9355"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.   It is also possible to force a derived key to be all zeros instead of an unpredictable value.   This may have follow-on implications for the Go TLS stack.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9355",
          "url": "https://www.suse.com/security/cve/CVE-2024-9355"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9355"
    },
    {
      "cve": "CVE-2024-9407",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9407"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9407",
          "url": "https://www.suse.com/security/cve/CVE-2024-9407"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231208 for CVE-2024-9407",
          "url": "https://bugzilla.suse.com/1231208"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9407"
    },
    {
      "cve": "CVE-2024-9486",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9486"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A security issue was discovered in the Kubernetes Image Builder versions \u003c= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9486",
          "url": "https://www.suse.com/security/cve/CVE-2024-9486"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2024-9486"
    },
    {
      "cve": "CVE-2024-9594",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9594"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A security issue was discovered in the Kubernetes Image Builder versions \u003c= v0.1.37 where default credentials are enabled during the image build process  when using the Nutanix, OVA, QEMU or raw providers. The credentials can be used to gain root access. The credentials are disabled at the conclusion of the image build process. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project. Because these images were vulnerable during the image build process, they are affected only if an attacker was able to reach the VM where the image build was happening and used the vulnerability to modify the image at the time the image build was occurring.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9594",
          "url": "https://www.suse.com/security/cve/CVE-2024-9594"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-9594"
    },
    {
      "cve": "CVE-2024-9675",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9675"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
          "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9675",
          "url": "https://www.suse.com/security/cve/CVE-2024-9675"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231499 for CVE-2024-9675",
          "url": "https://bugzilla.suse.com/1231499"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch",
            "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T07:45:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9675"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/golang-fips/openssl"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-9355"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-457"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-01T22:31:42Z",
    "nvd_published_at": "2024-10-01T19:15:09Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
  "id": "GHSA-3h3x-2hwv-hr52",
  "modified": "2025-05-14T18:30:40Z",
  "published": "2024-10-01T21:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
    },
    {
      "type": "WEB",
      "url": "https://github.com/golang-fips/openssl/pull/198"
    },
    {
      "type": "WEB",
      "url": "https://github.com/github/advisory-database/pull/4950"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2024-3167"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/golang-fips/openssl"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:7624"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:7256"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:7118"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:2416"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:9551"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:8847"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:8678"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:8327"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:7550"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:7502"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:10133"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for govulncheck-vulndb",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20241104T154416 2024-11-04T15:44:16Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3233 CVE-2024-46872 GHSA-762g-9p7f-mrww\n  * GO-2024-3234 CVE-2024-47401 GHSA-762v-rq7q-ff97\n  * GO-2024-3235 CVE-2024-50052 GHSA-g376-m3h3-mj4r\n  * GO-2024-3237 CVE-2024-0133 GHSA-f748-7hpg-88ch\n  * GO-2024-3239 CVE-2024-0132 GHSA-mjjw-553x-87pq\n  * GO-2024-3240 CVE-2024-10452 GHSA-66c4-2g2v-54qw\n  * GO-2024-3241 CVE-2024-10006 GHSA-5c4w-8hhh-3c3h\n  * GO-2024-3242 CVE-2024-10086 GHSA-99wr-c2px-grmh\n  * GO-2024-3243 CVE-2024-10005 GHSA-chgm-7r52-whjj\n\n- Update to version 0.0.20241101T215616 2024-11-01T21:56:16Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g\n  * GO-2024-3245 CVE-2024-39720\n  * GO-2024-3246 CVE-2024-8185 GHSA-g233-2p4r-3q7v\n\n- Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm\n  * GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh\n\n- Update to version 0.0.20241030T160108 2024-10-30T16:01:08Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr\n  * GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c\n  * GO-2024-3228 GHSA-wcx9-ccpj-hx3c\n- Packaging improvments:\n  * Backfill CVE aliases in recent changelog entries\n\n- Update to version 0.0.20241028T152002 2024-10-28T15:20:02Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3207 GHSA-p5wf-cmr4-xrwr\n  * GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6\n  * GO-2024-3210 CVE-2024-8901\n  * GO-2024-3211 CVE-2024-50312\n  * GO-2024-3212 GHSA-rjfv-pjvx-mjgv\n  * GO-2024-3213 CVE-2024-49380\n  * GO-2024-3214 CVE-2024-49381\n  * GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7\n  * GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv\n  * GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc\n  * GO-2024-3219 GHSA-7h65-4p22-39j6\n  * GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4\n  * GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc\n  * GO-2024-3222 GHSA-x7xj-jvwp-97rv\n  * GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v\n  * GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r\n\n- Update to version 0.0.20241017T153730 date 2024-10-17T15:37:30Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3203 CVE-2024-9486\n  * GO-2024-3204 CVE-2024-9594\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc\n  * GO-2024-3199 GHSA-vv6c-69r6-chg9\n  * GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj\n  * GO-2024-3201 CVE-2023-22644\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4\n  * GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3\n  * GO-2024-3163 CVE-2024-47182\n  * GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52\n  * GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h\n  * GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc\n  * GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4\n  * GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8\n  * GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4\n  * GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x\n  * GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq\n  * GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr\n  * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787\n  * GO-2024-3182 GHSA-wpr2-j6gr-pjw9\n  * GO-2024-3184 CVE-2024-36814 GHSA-9cp9-8gw2-8v7m\n  * GO-2024-3185 CVE-2024-47832\n  * GO-2024-3186 CVE-2024-9675 GHSA-586p-749j-fhwp\n  * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2\n  * GO-2024-3190 CVE-2024-47067 GHSA-8pph-gfhp-w226\n  * GO-2024-3191 CVE-2024-9180 GHSA-rr8j-7w34-xp5j",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2024-350",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_0350-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2024:0350-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2024:0350-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-45157 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-45157/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-22644 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-22644/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-32197 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-32197/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-0132 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-0132/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-0133 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-0133/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-10005 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-10005/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-10006 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-10006/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-10086 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-10086/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-10214 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-10214/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-10241 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-10241/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-10452 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-10452/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-22030 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-22030/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-22036 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-22036/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-33662 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-33662/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-36814 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-36814/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-38365 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-38365/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-39223 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-39223/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-39720 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-39720/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-46872 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-46872/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47003 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47003/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47067 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47067/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47182 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47182/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47401 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47401/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47534 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47534/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47616 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47616/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47825 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47825/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47827 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47827/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47832 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47832/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47877 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47877/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-48909 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-48909/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-48921 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-48921/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-49380 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-49380/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-49381 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-49381/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-49753 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-49753/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-49757 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-49757/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-50052 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-50052/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-50312 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-50312/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-50354 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-50354/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-7558 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-7558/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-7594 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-7594/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8037 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8037/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8038 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8038/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8185 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8185/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8901 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8901/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8975 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8975/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8996 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8996/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9180 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9180/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9264 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9264/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9312 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9312/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9313 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9313/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9341 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9341/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9355 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9355/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9407 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9407/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9486 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9486/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9594 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9594/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9675 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9675/"
      }
    ],
    "title": "Security update for govulncheck-vulndb",
    "tracking": {
      "current_release_date": "2024-11-05T14:52:20Z",
      "generator": {
        "date": "2024-11-05T14:52:20Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:0350-1",
      "initial_release_date": "2024-11-05T14:52:20Z",
      "revision_history": [
        {
          "date": "2024-11-05T14:52:20Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20241104T154416-5.1.noarch",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20241104T154416-5.1.noarch",
                  "product_id": "govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Package Hub 12",
                "product": {
                  "name": "SUSE Package Hub 12",
                  "product_id": "SUSE Package Hub 12",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:packagehub:12"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20241104T154416-5.1.noarch as component of SUSE Package Hub 12",
          "product_id": "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        },
        "product_reference": "govulncheck-vulndb-0.0.20241104T154416-5.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-45157",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-45157"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability has been identified in the way that Rancher stores vSphere\u0027s CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-45157",
          "url": "https://www.suse.com/security/cve/CVE-2022-45157"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231677 for CVE-2022-45157",
          "url": "https://bugzilla.suse.com/1231677"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2022-45157"
    },
    {
      "cve": "CVE-2023-22644",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-22644"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-22644",
          "url": "https://www.suse.com/security/cve/CVE-2023-22644"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1207199 for CVE-2023-22644",
          "url": "https://bugzilla.suse.com/1207199"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209434 for CVE-2023-22644",
          "url": "https://bugzilla.suse.com/1209434"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2023-22644"
    },
    {
      "cve": "CVE-2023-32197",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-32197"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-32197",
          "url": "https://www.suse.com/security/cve/CVE-2023-32197"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222643 for CVE-2023-32197",
          "url": "https://bugzilla.suse.com/1222643"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222681 for CVE-2023-32197",
          "url": "https://bugzilla.suse.com/1222681"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-32197"
    },
    {
      "cve": "CVE-2024-0132",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-0132"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-0132",
          "url": "https://www.suse.com/security/cve/CVE-2024-0132"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231033 for CVE-2024-0132",
          "url": "https://bugzilla.suse.com/1231033"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-0132"
    },
    {
      "cve": "CVE-2024-0133",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-0133"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-0133",
          "url": "https://www.suse.com/security/cve/CVE-2024-0133"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231032 for CVE-2024-0133",
          "url": "https://bugzilla.suse.com/1231032"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-0133"
    },
    {
      "cve": "CVE-2024-10005",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-10005"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was identified in Consul and Consul Enterprise (\"Consul\") such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-10005",
          "url": "https://www.suse.com/security/cve/CVE-2024-10005"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-10005"
    },
    {
      "cve": "CVE-2024-10006",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-10006"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was identified in Consul and Consul Enterprise (\"Consul\") such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-10006",
          "url": "https://www.suse.com/security/cve/CVE-2024-10006"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-10006"
    },
    {
      "cve": "CVE-2024-10086",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-10086"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-10086",
          "url": "https://www.suse.com/security/cve/CVE-2024-10086"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-10086"
    },
    {
      "cve": "CVE-2024-10214",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-10214"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 9.11.X \u003c= 9.11.1, 9.5.x \u003c= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-10214",
          "url": "https://www.suse.com/security/cve/CVE-2024-10214"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "low"
        }
      ],
      "title": "CVE-2024-10214"
    },
    {
      "cve": "CVE-2024-10241",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-10241"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 9.5.x \u003c= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get  private channel names by using cmd+K/ctrl+K.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-10241",
          "url": "https://www.suse.com/security/cve/CVE-2024-10241"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-10241"
    },
    {
      "cve": "CVE-2024-10452",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-10452"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Organization admins can delete pending invites created in an organization they are not part of.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-10452",
          "url": "https://www.suse.com/security/cve/CVE-2024-10452"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1232569 for CVE-2024-10452",
          "url": "https://bugzilla.suse.com/1232569"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "low"
        }
      ],
      "title": "CVE-2024-10452"
    },
    {
      "cve": "CVE-2024-22030",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-22030"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability has been identified within Rancher that can be exploited\n in narrow circumstances through a man-in-the-middle (MITM) attack. An \nattacker would need to have control of an expired domain or execute a \nDNS spoofing/hijacking attack against the domain to exploit this \nvulnerability. The targeted domain is the one used as the Rancher URL.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-22030",
          "url": "https://www.suse.com/security/cve/CVE-2024-22030"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1219982 for CVE-2024-22030",
          "url": "https://bugzilla.suse.com/1219982"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-22030"
    },
    {
      "cve": "CVE-2024-22036",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-22036"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-22036",
          "url": "https://www.suse.com/security/cve/CVE-2024-22036"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231280 for CVE-2024-22036",
          "url": "https://bugzilla.suse.com/1231280"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-22036"
    },
    {
      "cve": "CVE-2024-33662",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-33662"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-33662",
          "url": "https://www.suse.com/security/cve/CVE-2024-33662"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-33662"
    },
    {
      "cve": "CVE-2024-36814",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-36814"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An arbitrary file read vulnerability in Adguard Home before v0.107.52 allows authenticated attackers to access arbitrary files as root on the underlying Operating System via placing a crafted file into a readable directory.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-36814",
          "url": "https://www.suse.com/security/cve/CVE-2024-36814"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-36814"
    },
    {
      "cve": "CVE-2024-38365",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-38365"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core\u0027s \"FindAndDelete()\" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). This consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn\u0027t return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a \"standard\" Bitcoin transaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block. `removeOpcodeByData(script []byte, dataToRemove []byte)` removes any data pushes from `script` that contain `dataToRemove`. However, `FindAndDelete` only removes exact matches. So for example, with `script = \"\u003cdata\u003e \u003cdata||foo\u003e\"` and `dataToRemove = \"data\"` btcd will remove both data pushes but Bitcoin Core\u0027s `FindAndDelete` only removes the first `\u003cdata\u003e` push. This has been patched in btcd version v0.24.2. Users are advised to upgrade. There are no known workarounds for this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-38365",
          "url": "https://www.suse.com/security/cve/CVE-2024-38365"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-38365"
    },
    {
      "cve": "CVE-2024-39223",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-39223"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-39223",
          "url": "https://www.suse.com/security/cve/CVE-2024-39223"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2024-39223"
    },
    {
      "cve": "CVE-2024-39720",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-39720"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 bytes starting with the GGUF custom magic header. By leveraging a custom Modelfile that includes a FROM statement pointing to the attacker-controlled blob file, the attacker can crash the application through the CreateModel route, leading to a segmentation fault (signal SIGSEGV: segmentation violation).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-39720",
          "url": "https://www.suse.com/security/cve/CVE-2024-39720"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1232794 for CVE-2024-39720",
          "url": "https://bugzilla.suse.com/1232794"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-39720"
    },
    {
      "cve": "CVE-2024-46872",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-46872"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 9.10.x \u003c= 9.10.2, 9.11.x \u003c= 9.11.1, 9.5.x \u003c= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-46872",
          "url": "https://www.suse.com/security/cve/CVE-2024-46872"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-46872"
    },
    {
      "cve": "CVE-2024-47003",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47003"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 9.11.x \u003c= 9.11.0 and 9.5.x \u003c= 9.5.8 fail to validate that the message of the permalink post is a string,  which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47003",
          "url": "https://www.suse.com/security/cve/CVE-2024-47003"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47003"
    },
    {
      "cve": "CVE-2024-47067",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47067"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. The endpoint /i/:link_name takes in a user-provided value and reflects it back in the response. The endpoint returns an application/xml response, opening it up to HTML tags via XHTML and thus leading to a XSS vulnerability. This vulnerability is fixed in 3.29.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47067",
          "url": "https://www.suse.com/security/cve/CVE-2024-47067"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47067"
    },
    {
      "cve": "CVE-2024-47182",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47182"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches to bcrypt, a more appropriate hash for passwords, in version 8.5.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47182",
          "url": "https://www.suse.com/security/cve/CVE-2024-47182"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-47182"
    },
    {
      "cve": "CVE-2024-47401",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47401"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 9.10.x \u003c= 9.10.2, 9.11.x \u003c= 9.11.1 and 9.5.x \u003c= 9.5.9 fail to  prevent detailed error messages from being displayed  in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn could cause the application to crash by sending a specially crafted request to Playbooks.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47401",
          "url": "https://www.suse.com/security/cve/CVE-2024-47401"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47401"
    },
    {
      "cve": "CVE-2024-47534",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47534"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to \"A\", and to \"B\", and \"B\" delegates to \"C\", then the client should trace the delegations in the order \"A\" then \"B\" then \"C\" but it may incorrectly trace the delegations \"B\"-\u003e\"C\"-\u003e\"A\". This vulnerability is fixed in 2.0.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47534",
          "url": "https://www.suse.com/security/cve/CVE-2024-47534"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-47534"
    },
    {
      "cve": "CVE-2024-47616",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47616"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium application state. Requests to the databroker service API are authorized by the presence of a JSON Web Token (JWT) signed by a key known by all Pomerium services in the same deployment. However, incomplete validation of this JWT meant that some service account access tokens would incorrectly be treated as valid for the purpose of databroker API authorization. Improper access to the databroker API could allow exfiltration of user info, spoofing of user sessions, or tampering with Pomerium routes, policies, and other settings. A Pomerium deployment is susceptible to this issue if all of the following conditions are met, you have issued a service account access token using Pomerium Zero or Pomerium Enterprise, the access token has an explicit expiration date in the future, and the core Pomerium databroker gRPC API is not otherwise secured by network access controls. This vulnerability is fixed in 0.27.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47616",
          "url": "https://www.suse.com/security/cve/CVE-2024-47616"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47616"
    },
    {
      "cve": "CVE-2024-47825",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47825"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if there is a policy rule referencing a more narrow prefix (`CIDRSet` or `toFQDN`) and this narrower policy rule specifies either `enableDefaultDeny: false` or `- toEntities: all`. Note that a rule specifying `toEntities: world` or `toEntities: 0.0.0.0/0` is insufficient, it must be to entity `all`.This issue has been patched in Cilium v1.14.16 and v1.15.10. As this issue only affects policies using `enableDefaultDeny: false` or that set `toEntities` to `all`, some workarounds are available. For users with policies using `enableDefaultDeny: false`, remove this configuration option and explicitly define any allow rules required. For users with egress policies that explicitly specify `toEntities: all`, use `toEntities: world`.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47825",
          "url": "https://www.suse.com/security/cve/CVE-2024-47825"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-47825"
    },
    {
      "cve": "CVE-2024-47827",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47827"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47827",
          "url": "https://www.suse.com/security/cve/CVE-2024-47827"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47827"
    },
    {
      "cve": "CVE-2024-47832",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47832"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers. Users of https://ssoready.com, the public hosted instance of SSOReady, are unaffected. We advise folks who self-host SSOReady to upgrade to 7f92a06 or later. Do so by updating your SSOReady Docker images from sha-... to sha-7f92a06. There are no known workarounds for this vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47832",
          "url": "https://www.suse.com/security/cve/CVE-2024-47832"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2024-47832"
    },
    {
      "cve": "CVE-2024-47877",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47877"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This vulnerability is fixed in 4.0.0. If you\u0027re using the Extractor.FS interface, then upgrading to /v4 will require to implement the new methods that have been added.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47877",
          "url": "https://www.suse.com/security/cve/CVE-2024-47877"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47877"
    },
    {
      "cve": "CVE-2024-48909",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-48909"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-48909",
          "url": "https://www.suse.com/security/cve/CVE-2024-48909"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "low"
        }
      ],
      "title": "CVE-2024-48909"
    },
    {
      "cve": "CVE-2024-48921",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-48921"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. \"disallow-privileged-containers,\" can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. This vulnerability is fixed in 1.13.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-48921",
          "url": "https://www.suse.com/security/cve/CVE-2024-48921"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1232557 for CVE-2024-48921",
          "url": "https://bugzilla.suse.com/1232557"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-48921"
    },
    {
      "cve": "CVE-2024-49380",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-49380"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-49380",
          "url": "https://www.suse.com/security/cve/CVE-2024-49380"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-49380"
    },
    {
      "cve": "CVE-2024-49381",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-49381"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write deletion when a plenti user serves their website. This issue may lead to information loss. Version 0.7.2 fixes the vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-49381",
          "url": "https://www.suse.com/security/cve/CVE-2024-49381"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-49381"
    },
    {
      "cve": "CVE-2024-49753",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-49753"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost (127.0.0.1). The isHostBlocked check, designed to prevent such requests, can be circumvented by creating a DNS record that resolves to 127.0.0.1. This enables actions to send requests to localhost despite the intended security measures. This vulnerability potentially allows unauthorized access to unsecured internal endpoints, which may contain sensitive information or functionalities. Versions 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-49753",
          "url": "https://www.suse.com/security/cve/CVE-2024-49753"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-49753"
    },
    {
      "cve": "CVE-2024-49757",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-49757"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the \"User Registration allowed\" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-49757",
          "url": "https://www.suse.com/security/cve/CVE-2024-49757"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-49757"
    },
    {
      "cve": "CVE-2024-50052",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-50052"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 9.10.x \u003c= 9.10.2, 9.11.x \u003c= 9.11.1, 9.5.x \u003c= 9.5.9 fail to  check that the origin of the message in an integration action matches with the original post metadata  which allows an authenticated user to delete an arbitrary post.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-50052",
          "url": "https://www.suse.com/security/cve/CVE-2024-50052"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-50052"
    },
    {
      "cve": "CVE-2024-50312",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-50312"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application\u0027s GraphQL implementation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-50312",
          "url": "https://www.suse.com/security/cve/CVE-2024-50312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-50312"
    },
    {
      "cve": "CVE-2024-50354",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-50354"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-50354",
          "url": "https://www.suse.com/security/cve/CVE-2024-50354"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-50354"
    },
    {
      "cve": "CVE-2024-7558",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-7558"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-7558",
          "url": "https://www.suse.com/security/cve/CVE-2024-7558"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-7558"
    },
    {
      "cve": "CVE-2024-7594",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-7594"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vault\u0027s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault\u0027s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-7594",
          "url": "https://www.suse.com/security/cve/CVE-2024-7594"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-7594"
    },
    {
      "cve": "CVE-2024-8037",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8037"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8037",
          "url": "https://www.suse.com/security/cve/CVE-2024-8037"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-8037"
    },
    {
      "cve": "CVE-2024-8038",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8038"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8038",
          "url": "https://www.suse.com/security/cve/CVE-2024-8038"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-8038"
    },
    {
      "cve": "CVE-2024-8185",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8185"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vault Community and Vault Enterprise (\"Vault\") clusters using Vault\u0027s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vault to consume excessive system memory resources, potentially leading to a crash of the underlying system and the Vault process itself.\n\nThis vulnerability, CVE-2024-8185, is fixed in Vault Community 1.18.1 and Vault Enterprise 1.18.1, 1.17.8, and 1.16.12.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8185",
          "url": "https://www.suse.com/security/cve/CVE-2024-8185"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1232752 for CVE-2024-8185",
          "url": "https://bugzilla.suse.com/1232752"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-8185"
    },
    {
      "cve": "CVE-2024-8901",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8901"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The  AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master  provides an OIDC authentication mechanism that was integrated into the open source Kubeflow project. The adapter uses JWT for authentication, but lacks proper signer and issuer validation. In deployments of ALB that ignore security best practices, where ALB targets are directly exposed to internet traffic, an actor can provide a JWT signed by an untrusted entity in order to spoof OIDC-federated sessions and successfully bypass authentication.\n\n\n\nThe repository/package has been deprecated, is end of life, and is no longer supported. As a security best practice, ensure that your ELB targets (e.g. EC2 Instances, Fargate Tasks etc.) do not have public IP addresses. Ensure any forked or derivative code validate that the signer  attribute in the JWT match the ARN of the Application Load Balancer that the service is configured to use.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8901",
          "url": "https://www.suse.com/security/cve/CVE-2024-8901"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-8901"
    },
    {
      "cve": "CVE-2024-8975",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8975"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM\nThis issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8975",
          "url": "https://www.suse.com/security/cve/CVE-2024-8975"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-8975"
    },
    {
      "cve": "CVE-2024-8996",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8996"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM\nThis issue affects Agent Flow: before 0.43.2",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8996",
          "url": "https://www.suse.com/security/cve/CVE-2024-8996"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-8996"
    },
    {
      "cve": "CVE-2024-9180",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9180"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A privileged Vault operator with write permissions to the root namespace\u0027s identity endpoint could escalate their own or another user\u0027s privileges to Vault\u0027s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9180",
          "url": "https://www.suse.com/security/cve/CVE-2024-9180"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-9180"
    },
    {
      "cve": "CVE-2024-9264",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9264"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack.  The `duckdb` binary must be present in Grafana\u0027s $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9264",
          "url": "https://www.suse.com/security/cve/CVE-2024-9264"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231844 for CVE-2024-9264",
          "url": "https://bugzilla.suse.com/1231844"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2024-9264"
    },
    {
      "cve": "CVE-2024-9312",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9312"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user\u0027s ID and gain their privileges.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9312",
          "url": "https://www.suse.com/security/cve/CVE-2024-9312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-9312"
    },
    {
      "cve": "CVE-2024-9313",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9313"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9313",
          "url": "https://www.suse.com/security/cve/CVE-2024-9313"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-9313"
    },
    {
      "cve": "CVE-2024-9341",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9341"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9341",
          "url": "https://www.suse.com/security/cve/CVE-2024-9341"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231230 for CVE-2024-9341",
          "url": "https://bugzilla.suse.com/1231230"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9341"
    },
    {
      "cve": "CVE-2024-9355",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9355"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.   It is also possible to force a derived key to be all zeros instead of an unpredictable value.   This may have follow-on implications for the Go TLS stack.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9355",
          "url": "https://www.suse.com/security/cve/CVE-2024-9355"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9355"
    },
    {
      "cve": "CVE-2024-9407",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9407"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9407",
          "url": "https://www.suse.com/security/cve/CVE-2024-9407"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231208 for CVE-2024-9407",
          "url": "https://bugzilla.suse.com/1231208"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9407"
    },
    {
      "cve": "CVE-2024-9486",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9486"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A security issue was discovered in the Kubernetes Image Builder versions \u003c= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9486",
          "url": "https://www.suse.com/security/cve/CVE-2024-9486"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2024-9486"
    },
    {
      "cve": "CVE-2024-9594",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9594"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A security issue was discovered in the Kubernetes Image Builder versions \u003c= v0.1.37 where default credentials are enabled during the image build process  when using the Nutanix, OVA, QEMU or raw providers. The credentials can be used to gain root access. The credentials are disabled at the conclusion of the image build process. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project. Because these images were vulnerable during the image build process, they are affected only if an attacker was able to reach the VM where the image build was happening and used the vulnerability to modify the image at the time the image build was occurring.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9594",
          "url": "https://www.suse.com/security/cve/CVE-2024-9594"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-9594"
    },
    {
      "cve": "CVE-2024-9675",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9675"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9675",
          "url": "https://www.suse.com/security/cve/CVE-2024-9675"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231499 for CVE-2024-9675",
          "url": "https://bugzilla.suse.com/1231499"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-05T14:52:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9675"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "govulncheck-vulndb-0.0.20241030T212825-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the govulncheck-vulndb-0.0.20241030T212825-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-14447",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_14447-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2024:14447-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2024:14447-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-45157 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-45157/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-22644 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-22644/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-32197 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-32197/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-10214 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-10214/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-10241 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-10241/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-22030 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-22030/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-22036 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-22036/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-33662 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-33662/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-36814 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-36814/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-38365 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-38365/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-39223 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-39223/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47003 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47003/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47067 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47067/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47182 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47182/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47534 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47534/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47616 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47616/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47825 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47825/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47827 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47827/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47832 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47832/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47877 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47877/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-48909 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-48909/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-48921 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-48921/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-49380 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-49380/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-49381 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-49381/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-49753 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-49753/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-49757 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-49757/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-50312 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-50312/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-7558 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-7558/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-7594 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-7594/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8037 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8037/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8038 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8038/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8901 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8901/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8975 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8975/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8996 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8996/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9180 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9180/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9264 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9264/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9312 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9312/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9313 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9313/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9341 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9341/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9355 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9355/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9407 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9407/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9486 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9486/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9594 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9594/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9675 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9675/"
      }
    ],
    "title": "govulncheck-vulndb-0.0.20241030T212825-1.1 on GA media",
    "tracking": {
      "current_release_date": "2024-11-01T00:00:00Z",
      "generator": {
        "date": "2024-11-01T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:14447-1",
      "initial_release_date": "2024-11-01T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-11-01T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
                  "product_id": "govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
                  "product_id": "govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
                  "product_id": "govulncheck-vulndb-0.0.20241030T212825-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64",
                  "product_id": "govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64"
        },
        "product_reference": "govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le"
        },
        "product_reference": "govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20241030T212825-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x"
        },
        "product_reference": "govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        },
        "product_reference": "govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-45157",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-45157"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability has been identified in the way that Rancher stores vSphere\u0027s CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-45157",
          "url": "https://www.suse.com/security/cve/CVE-2022-45157"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231677 for CVE-2022-45157",
          "url": "https://bugzilla.suse.com/1231677"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2022-45157"
    },
    {
      "cve": "CVE-2023-22644",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-22644"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-22644",
          "url": "https://www.suse.com/security/cve/CVE-2023-22644"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1207199 for CVE-2023-22644",
          "url": "https://bugzilla.suse.com/1207199"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209434 for CVE-2023-22644",
          "url": "https://bugzilla.suse.com/1209434"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2023-22644"
    },
    {
      "cve": "CVE-2023-32197",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-32197"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-32197",
          "url": "https://www.suse.com/security/cve/CVE-2023-32197"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222643 for CVE-2023-32197",
          "url": "https://bugzilla.suse.com/1222643"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222681 for CVE-2023-32197",
          "url": "https://bugzilla.suse.com/1222681"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-32197"
    },
    {
      "cve": "CVE-2024-10214",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-10214"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 9.11.X \u003c= 9.11.1, 9.5.x \u003c= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-10214",
          "url": "https://www.suse.com/security/cve/CVE-2024-10214"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2024-10214"
    },
    {
      "cve": "CVE-2024-10241",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-10241"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 9.5.x \u003c= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get  private channel names by using cmd+K/ctrl+K.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-10241",
          "url": "https://www.suse.com/security/cve/CVE-2024-10241"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-10241"
    },
    {
      "cve": "CVE-2024-22030",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-22030"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability has been identified within Rancher that can be exploited\n in narrow circumstances through a man-in-the-middle (MITM) attack. An \nattacker would need to have control of an expired domain or execute a \nDNS spoofing/hijacking attack against the domain to exploit this \nvulnerability. The targeted domain is the one used as the Rancher URL.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-22030",
          "url": "https://www.suse.com/security/cve/CVE-2024-22030"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1219982 for CVE-2024-22030",
          "url": "https://bugzilla.suse.com/1219982"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-22030"
    },
    {
      "cve": "CVE-2024-22036",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-22036"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-22036",
          "url": "https://www.suse.com/security/cve/CVE-2024-22036"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231280 for CVE-2024-22036",
          "url": "https://bugzilla.suse.com/1231280"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-22036"
    },
    {
      "cve": "CVE-2024-33662",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-33662"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-33662",
          "url": "https://www.suse.com/security/cve/CVE-2024-33662"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-33662"
    },
    {
      "cve": "CVE-2024-36814",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-36814"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An arbitrary file read vulnerability in Adguard Home before v0.107.52 allows authenticated attackers to access arbitrary files as root on the underlying Operating System via placing a crafted file into a readable directory.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-36814",
          "url": "https://www.suse.com/security/cve/CVE-2024-36814"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-36814"
    },
    {
      "cve": "CVE-2024-38365",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-38365"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core\u0027s \"FindAndDelete()\" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). This consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn\u0027t return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a \"standard\" Bitcoin transaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block. `removeOpcodeByData(script []byte, dataToRemove []byte)` removes any data pushes from `script` that contain `dataToRemove`. However, `FindAndDelete` only removes exact matches. So for example, with `script = \"\u003cdata\u003e \u003cdata||foo\u003e\"` and `dataToRemove = \"data\"` btcd will remove both data pushes but Bitcoin Core\u0027s `FindAndDelete` only removes the first `\u003cdata\u003e` push. This has been patched in btcd version v0.24.2. Users are advised to upgrade. There are no known workarounds for this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-38365",
          "url": "https://www.suse.com/security/cve/CVE-2024-38365"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-38365"
    },
    {
      "cve": "CVE-2024-39223",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-39223"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-39223",
          "url": "https://www.suse.com/security/cve/CVE-2024-39223"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2024-39223"
    },
    {
      "cve": "CVE-2024-47003",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47003"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 9.11.x \u003c= 9.11.0 and 9.5.x \u003c= 9.5.8 fail to validate that the message of the permalink post is a string,  which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47003",
          "url": "https://www.suse.com/security/cve/CVE-2024-47003"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47003"
    },
    {
      "cve": "CVE-2024-47067",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47067"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. The endpoint /i/:link_name takes in a user-provided value and reflects it back in the response. The endpoint returns an application/xml response, opening it up to HTML tags via XHTML and thus leading to a XSS vulnerability. This vulnerability is fixed in 3.29.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47067",
          "url": "https://www.suse.com/security/cve/CVE-2024-47067"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47067"
    },
    {
      "cve": "CVE-2024-47182",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47182"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches to bcrypt, a more appropriate hash for passwords, in version 8.5.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47182",
          "url": "https://www.suse.com/security/cve/CVE-2024-47182"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-47182"
    },
    {
      "cve": "CVE-2024-47534",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47534"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to \"A\", and to \"B\", and \"B\" delegates to \"C\", then the client should trace the delegations in the order \"A\" then \"B\" then \"C\" but it may incorrectly trace the delegations \"B\"-\u003e\"C\"-\u003e\"A\". This vulnerability is fixed in 2.0.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47534",
          "url": "https://www.suse.com/security/cve/CVE-2024-47534"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-47534"
    },
    {
      "cve": "CVE-2024-47616",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47616"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium application state. Requests to the databroker service API are authorized by the presence of a JSON Web Token (JWT) signed by a key known by all Pomerium services in the same deployment. However, incomplete validation of this JWT meant that some service account access tokens would incorrectly be treated as valid for the purpose of databroker API authorization. Improper access to the databroker API could allow exfiltration of user info, spoofing of user sessions, or tampering with Pomerium routes, policies, and other settings. A Pomerium deployment is susceptible to this issue if all of the following conditions are met, you have issued a service account access token using Pomerium Zero or Pomerium Enterprise, the access token has an explicit expiration date in the future, and the core Pomerium databroker gRPC API is not otherwise secured by network access controls. This vulnerability is fixed in 0.27.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47616",
          "url": "https://www.suse.com/security/cve/CVE-2024-47616"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47616"
    },
    {
      "cve": "CVE-2024-47825",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47825"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if there is a policy rule referencing a more narrow prefix (`CIDRSet` or `toFQDN`) and this narrower policy rule specifies either `enableDefaultDeny: false` or `- toEntities: all`. Note that a rule specifying `toEntities: world` or `toEntities: 0.0.0.0/0` is insufficient, it must be to entity `all`.This issue has been patched in Cilium v1.14.16 and v1.15.10. As this issue only affects policies using `enableDefaultDeny: false` or that set `toEntities` to `all`, some workarounds are available. For users with policies using `enableDefaultDeny: false`, remove this configuration option and explicitly define any allow rules required. For users with egress policies that explicitly specify `toEntities: all`, use `toEntities: world`.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47825",
          "url": "https://www.suse.com/security/cve/CVE-2024-47825"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-47825"
    },
    {
      "cve": "CVE-2024-47827",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47827"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47827",
          "url": "https://www.suse.com/security/cve/CVE-2024-47827"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47827"
    },
    {
      "cve": "CVE-2024-47832",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47832"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers. Users of https://ssoready.com, the public hosted instance of SSOReady, are unaffected. We advise folks who self-host SSOReady to upgrade to 7f92a06 or later. Do so by updating your SSOReady Docker images from sha-... to sha-7f92a06. There are no known workarounds for this vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47832",
          "url": "https://www.suse.com/security/cve/CVE-2024-47832"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2024-47832"
    },
    {
      "cve": "CVE-2024-47877",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47877"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This vulnerability is fixed in 4.0.0. If you\u0027re using the Extractor.FS interface, then upgrading to /v4 will require to implement the new methods that have been added.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47877",
          "url": "https://www.suse.com/security/cve/CVE-2024-47877"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47877"
    },
    {
      "cve": "CVE-2024-48909",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-48909"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-48909",
          "url": "https://www.suse.com/security/cve/CVE-2024-48909"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2024-48909"
    },
    {
      "cve": "CVE-2024-48921",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-48921"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. \"disallow-privileged-containers,\" can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. This vulnerability is fixed in 1.13.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-48921",
          "url": "https://www.suse.com/security/cve/CVE-2024-48921"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1232557 for CVE-2024-48921",
          "url": "https://bugzilla.suse.com/1232557"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-48921"
    },
    {
      "cve": "CVE-2024-49380",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-49380"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-49380",
          "url": "https://www.suse.com/security/cve/CVE-2024-49380"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-49380"
    },
    {
      "cve": "CVE-2024-49381",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-49381"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write deletion when a plenti user serves their website. This issue may lead to information loss. Version 0.7.2 fixes the vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-49381",
          "url": "https://www.suse.com/security/cve/CVE-2024-49381"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-49381"
    },
    {
      "cve": "CVE-2024-49753",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-49753"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost (127.0.0.1). The isHostBlocked check, designed to prevent such requests, can be circumvented by creating a DNS record that resolves to 127.0.0.1. This enables actions to send requests to localhost despite the intended security measures. This vulnerability potentially allows unauthorized access to unsecured internal endpoints, which may contain sensitive information or functionalities. Versions 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-49753",
          "url": "https://www.suse.com/security/cve/CVE-2024-49753"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-49753"
    },
    {
      "cve": "CVE-2024-49757",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-49757"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the \"User Registration allowed\" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-49757",
          "url": "https://www.suse.com/security/cve/CVE-2024-49757"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-49757"
    },
    {
      "cve": "CVE-2024-50312",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-50312"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application\u0027s GraphQL implementation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-50312",
          "url": "https://www.suse.com/security/cve/CVE-2024-50312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-50312"
    },
    {
      "cve": "CVE-2024-7558",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-7558"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-7558",
          "url": "https://www.suse.com/security/cve/CVE-2024-7558"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-7558"
    },
    {
      "cve": "CVE-2024-7594",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-7594"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vault\u0027s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault\u0027s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-7594",
          "url": "https://www.suse.com/security/cve/CVE-2024-7594"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-7594"
    },
    {
      "cve": "CVE-2024-8037",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8037"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8037",
          "url": "https://www.suse.com/security/cve/CVE-2024-8037"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-8037"
    },
    {
      "cve": "CVE-2024-8038",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8038"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8038",
          "url": "https://www.suse.com/security/cve/CVE-2024-8038"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-8038"
    },
    {
      "cve": "CVE-2024-8901",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8901"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The  AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master  provides an OIDC authentication mechanism that was integrated into the open source Kubeflow project. The adapter uses JWT for authentication, but lacks proper signer and issuer validation. In deployments of ALB that ignore security best practices, where ALB targets are directly exposed to internet traffic, an actor can provide a JWT signed by an untrusted entity in order to spoof OIDC-federated sessions and successfully bypass authentication.\n\n\n\nThe repository/package has been deprecated, is end of life, and is no longer supported. As a security best practice, ensure that your ELB targets (e.g. EC2 Instances, Fargate Tasks etc.) do not have public IP addresses. Ensure any forked or derivative code validate that the signer  attribute in the JWT match the ARN of the Application Load Balancer that the service is configured to use.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8901",
          "url": "https://www.suse.com/security/cve/CVE-2024-8901"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-8901"
    },
    {
      "cve": "CVE-2024-8975",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8975"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM\nThis issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8975",
          "url": "https://www.suse.com/security/cve/CVE-2024-8975"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-8975"
    },
    {
      "cve": "CVE-2024-8996",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8996"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM\nThis issue affects Agent Flow: before 0.43.2",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8996",
          "url": "https://www.suse.com/security/cve/CVE-2024-8996"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-8996"
    },
    {
      "cve": "CVE-2024-9180",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9180"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A privileged Vault operator with write permissions to the root namespace\u0027s identity endpoint could escalate their own or another user\u0027s privileges to Vault\u0027s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9180",
          "url": "https://www.suse.com/security/cve/CVE-2024-9180"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-9180"
    },
    {
      "cve": "CVE-2024-9264",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9264"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack.  The `duckdb` binary must be present in Grafana\u0027s $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9264",
          "url": "https://www.suse.com/security/cve/CVE-2024-9264"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231844 for CVE-2024-9264",
          "url": "https://bugzilla.suse.com/1231844"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2024-9264"
    },
    {
      "cve": "CVE-2024-9312",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9312"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user\u0027s ID and gain their privileges.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9312",
          "url": "https://www.suse.com/security/cve/CVE-2024-9312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-9312"
    },
    {
      "cve": "CVE-2024-9313",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9313"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9313",
          "url": "https://www.suse.com/security/cve/CVE-2024-9313"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-9313"
    },
    {
      "cve": "CVE-2024-9341",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9341"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9341",
          "url": "https://www.suse.com/security/cve/CVE-2024-9341"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231230 for CVE-2024-9341",
          "url": "https://bugzilla.suse.com/1231230"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9341"
    },
    {
      "cve": "CVE-2024-9355",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9355"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.   It is also possible to force a derived key to be all zeros instead of an unpredictable value.   This may have follow-on implications for the Go TLS stack.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9355",
          "url": "https://www.suse.com/security/cve/CVE-2024-9355"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9355"
    },
    {
      "cve": "CVE-2024-9407",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9407"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9407",
          "url": "https://www.suse.com/security/cve/CVE-2024-9407"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231208 for CVE-2024-9407",
          "url": "https://bugzilla.suse.com/1231208"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9407"
    },
    {
      "cve": "CVE-2024-9486",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9486"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A security issue was discovered in the Kubernetes Image Builder versions \u003c= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9486",
          "url": "https://www.suse.com/security/cve/CVE-2024-9486"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2024-9486"
    },
    {
      "cve": "CVE-2024-9594",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9594"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A security issue was discovered in the Kubernetes Image Builder versions \u003c= v0.1.37 where default credentials are enabled during the image build process  when using the Nutanix, OVA, QEMU or raw providers. The credentials can be used to gain root access. The credentials are disabled at the conclusion of the image build process. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project. Because these images were vulnerable during the image build process, they are affected only if an attacker was able to reach the VM where the image build was happening and used the vulnerability to modify the image at the time the image build was occurring.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9594",
          "url": "https://www.suse.com/security/cve/CVE-2024-9594"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-9594"
    },
    {
      "cve": "CVE-2024-9675",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9675"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9675",
          "url": "https://www.suse.com/security/cve/CVE-2024-9675"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231499 for CVE-2024-9675",
          "url": "https://bugzilla.suse.com/1231499"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9675"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Go ist eine quelloffene Programmiersprache.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein lokaler Angreifer kann eine Schwachstelle in der Golang Go Komponente \"FIPS OpenSSL\" ausnutzen, um einen nicht n\u00e4her spezifizierten Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-3075 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3075.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-3075 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3075"
      },
      {
        "category": "external",
        "summary": "Oracle Enterprise Linux Security Advisory ELSA-2024-7502 vom 2024-10-03",
        "url": "https://linux.oracle.com/errata/ELSA-2024-7502.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:7502 vom 2024-10-03",
        "url": "https://access.redhat.com/errata/RHSA-2024:7502"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:7550 vom 2024-10-03",
        "url": "https://access.redhat.com/errata/RHSA-2024:7550"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-7550 vom 2024-10-14",
        "url": "http://linux.oracle.com/errata/ELSA-2024-7550.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-8327 vom 2024-10-23",
        "url": "https://linux.oracle.com/errata/ELSA-2024-8327.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:8327 vom 2024-10-22",
        "url": "https://access.redhat.com/errata/RHSA-2024:8327"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2024:7502 vom 2024-10-25",
        "url": "https://errata.build.resf.org/RLSA-2024:7502"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2024:7550 vom 2024-10-25",
        "url": "https://errata.build.resf.org/RLSA-2024:7550"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:8678 vom 2024-10-30",
        "url": "https://access.redhat.com/errata/RHSA-2024:8678"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-8678 vom 2024-10-31",
        "url": "http://linux.oracle.com/errata/ELSA-2024-8678.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:8847 vom 2024-11-05",
        "url": "https://access.redhat.com/errata/RHSA-2024:8847"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-8847 vom 2024-11-06",
        "url": "https://linux.oracle.com/errata/ELSA-2024-8847.html"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2024:8847 vom 2024-11-08",
        "url": "https://errata.build.resf.org/RLSA-2024:8847"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2024:8678 vom 2024-11-08",
        "url": "https://errata.build.resf.org/RLSA-2024:8678"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:9551 vom 2024-11-13",
        "url": "https://access.redhat.com/errata/RHSA-2024:9551"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7180361 vom 2025-01-07",
        "url": "https://www.ibm.com/support/pages/node/7180361"
      }
    ],
    "source_lang": "en-US",
    "title": "Golang Go \"FIPS OpenSSL\": Schwachstelle erm\u00f6glicht nicht spezifizierten Angriff",
    "tracking": {
      "current_release_date": "2025-01-06T23:00:00.000+00:00",
      "generator": {
        "date": "2025-01-07T11:42:21.039+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.10"
        }
      },
      "id": "WID-SEC-W-2024-3075",
      "initial_release_date": "2024-10-03T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-10-03T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-10-14T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2024-10-22T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Oracle Linux und Red Hat aufgenommen"
        },
        {
          "date": "2024-10-27T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
        },
        {
          "date": "2024-10-30T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-10-31T23:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2024-11-04T23:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-11-05T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2024-11-10T23:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
        },
        {
          "date": "2024-11-13T23:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-01-06T23:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von IBM aufgenommen"
        }
      ],
      "status": "final",
      "version": "11"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "FIPS OpenSSL",
                "product": {
                  "name": "Golang Go FIPS OpenSSL",
                  "product_id": "T037963",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:golang:go:fips_openssl"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Go"
          }
        ],
        "category": "vendor",
        "name": "Golang"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.1.6.4",
                "product": {
                  "name": "IBM Spectrum Protect Plus \u003c10.1.6.4",
                  "product_id": "T040030"
                }
              },
              {
                "category": "product_version",
                "name": "10.1.6.4",
                "product": {
                  "name": "IBM Spectrum Protect Plus 10.1.6.4",
                  "product_id": "T040030-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spectrum_protect_plus:10.1.6.4"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spectrum Protect Plus"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Oracle Linux",
                "product": {
                  "name": "Oracle Linux",
                  "product_id": "T004914",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:oracle:linux:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Oracle Linux",
                "product": {
                  "name": "Oracle Linux",
                  "product_id": "T031999",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:oracle:linux:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Linux"
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "RESF Rocky Linux",
            "product": {
              "name": "RESF Rocky Linux",
              "product_id": "T032255",
              "product_identification_helper": {
                "cpe": "cpe:/o:resf:rocky_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "RESF"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "T032039",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-9355",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Golang Go in der \"FIPS OpenSSL\" Komponente. Ursache ist eine nicht initialisierte Puffer-L\u00e4ngenvariable. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um verschiedene, anwendungsabh\u00e4ngige Auswirkungen zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T032039",
          "T040030",
          "67646",
          "T031999",
          "T037963",
          "T004914",
          "T032255"
        ]
      },
      "release_date": "2024-10-03T22:00:00.000+00:00",
      "title": "CVE-2024-9355"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Go ist eine quelloffene Programmiersprache.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein lokaler Angreifer kann eine Schwachstelle in der Golang Go Komponente \"FIPS OpenSSL\" ausnutzen, um einen nicht n\u00e4her spezifizierten Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-3075 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3075.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-3075 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3075"
      },
      {
        "category": "external",
        "summary": "Oracle Enterprise Linux Security Advisory ELSA-2024-7502 vom 2024-10-03",
        "url": "https://linux.oracle.com/errata/ELSA-2024-7502.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:7502 vom 2024-10-03",
        "url": "https://access.redhat.com/errata/RHSA-2024:7502"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:7550 vom 2024-10-03",
        "url": "https://access.redhat.com/errata/RHSA-2024:7550"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-7550 vom 2024-10-14",
        "url": "http://linux.oracle.com/errata/ELSA-2024-7550.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-8327 vom 2024-10-23",
        "url": "https://linux.oracle.com/errata/ELSA-2024-8327.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:8327 vom 2024-10-22",
        "url": "https://access.redhat.com/errata/RHSA-2024:8327"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2024:7502 vom 2024-10-25",
        "url": "https://errata.build.resf.org/RLSA-2024:7502"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2024:7550 vom 2024-10-25",
        "url": "https://errata.build.resf.org/RLSA-2024:7550"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:8678 vom 2024-10-30",
        "url": "https://access.redhat.com/errata/RHSA-2024:8678"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-8678 vom 2024-10-31",
        "url": "http://linux.oracle.com/errata/ELSA-2024-8678.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:8847 vom 2024-11-05",
        "url": "https://access.redhat.com/errata/RHSA-2024:8847"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-8847 vom 2024-11-06",
        "url": "https://linux.oracle.com/errata/ELSA-2024-8847.html"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2024:8847 vom 2024-11-08",
        "url": "https://errata.build.resf.org/RLSA-2024:8847"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2024:8678 vom 2024-11-08",
        "url": "https://errata.build.resf.org/RLSA-2024:8678"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:9551 vom 2024-11-13",
        "url": "https://access.redhat.com/errata/RHSA-2024:9551"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7180361 vom 2025-01-07",
        "url": "https://www.ibm.com/support/pages/node/7180361"
      }
    ],
    "source_lang": "en-US",
    "title": "Golang Go \"FIPS OpenSSL\": Schwachstelle erm\u00f6glicht nicht spezifizierten Angriff",
    "tracking": {
      "current_release_date": "2025-01-06T23:00:00.000+00:00",
      "generator": {
        "date": "2025-01-07T11:42:21.039+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.10"
        }
      },
      "id": "WID-SEC-W-2024-3075",
      "initial_release_date": "2024-10-03T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-10-03T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-10-14T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2024-10-22T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Oracle Linux und Red Hat aufgenommen"
        },
        {
          "date": "2024-10-27T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
        },
        {
          "date": "2024-10-30T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-10-31T23:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2024-11-04T23:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-11-05T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2024-11-10T23:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
        },
        {
          "date": "2024-11-13T23:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-01-06T23:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von IBM aufgenommen"
        }
      ],
      "status": "final",
      "version": "11"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "FIPS OpenSSL",
                "product": {
                  "name": "Golang Go FIPS OpenSSL",
                  "product_id": "T037963",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:golang:go:fips_openssl"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Go"
          }
        ],
        "category": "vendor",
        "name": "Golang"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.1.6.4",
                "product": {
                  "name": "IBM Spectrum Protect Plus \u003c10.1.6.4",
                  "product_id": "T040030"
                }
              },
              {
                "category": "product_version",
                "name": "10.1.6.4",
                "product": {
                  "name": "IBM Spectrum Protect Plus 10.1.6.4",
                  "product_id": "T040030-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spectrum_protect_plus:10.1.6.4"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spectrum Protect Plus"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Oracle Linux",
                "product": {
                  "name": "Oracle Linux",
                  "product_id": "T004914",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:oracle:linux:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Oracle Linux",
                "product": {
                  "name": "Oracle Linux",
                  "product_id": "T031999",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:oracle:linux:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Linux"
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "RESF Rocky Linux",
            "product": {
              "name": "RESF Rocky Linux",
              "product_id": "T032255",
              "product_identification_helper": {
                "cpe": "cpe:/o:resf:rocky_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "RESF"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "T032039",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-9355",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Golang Go in der \"FIPS OpenSSL\" Komponente. Ursache ist eine nicht initialisierte Puffer-L\u00e4ngenvariable. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um verschiedene, anwendungsabh\u00e4ngige Auswirkungen zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T032039",
          "T040030",
          "67646",
          "T031999",
          "T037963",
          "T004914",
          "T032255"
        ]
      },
      "release_date": "2024-10-03T22:00:00.000+00:00",
      "title": "CVE-2024-9355"
    }
  ]
}

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack."
    },
    {
      "lang": "es",
      "value": "Se encontr\u00f3 una vulnerabilidad en Golang FIPS OpenSSL. Esta falla permite que un usuario malintencionado haga que se devuelva aleatoriamente una variable de longitud de b\u00fafer no inicializada con un b\u00fafer puesto a cero en modo FIPS. Tambi\u00e9n es posible forzar una coincidencia de falso positivo entre hashes no iguales al comparar una suma hmac calculada confiable con una suma de entrada no confiable si un atacante puede enviar un b\u00fafer puesto a cero en lugar de una suma calculada previamente. Tambi\u00e9n es posible forzar que una clave derivada sea todo ceros en lugar de un valor impredecible. Esto puede tener implicaciones posteriores para la pila TLS de Go."
    }
  ],
  "id": "CVE-2024-9355",
  "lastModified": "2025-05-14T18:15:29.493",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 5.5,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-10-01T19:15:09.793",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2024:10133"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2024:7502"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2024:7550"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2024:8327"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2024:8678"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2024:8847"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2024:9551"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2025:2416"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2025:7118"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2025:7256"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2025:7624"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-457"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}