{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-2786",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-02T13:53:24.818603Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-02T13:53:48.875Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "affected",
               packageName: "rhosdt/tempo-gateway-opa-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "affected",
               packageName: "rhosdt/tempo-gateway-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "affected",
               packageName: "rhosdt/tempo-jaeger-query-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "affected",
               packageName: "rhosdt/tempo-query-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "affected",
               packageName: "rhosdt/tempo-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "affected",
               packageName: "rhosdt/tempo-rhel8-operator",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2025-03-25T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users' permissions. While this does not allow privilege escalation or impersonation, it exposes information that could aid in gathering information for further attacks.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Moderate",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "Exposure of Sensitive Information to an Unauthorized Actor",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-04-02T11:07:43.285Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2025-2786",
            },
            {
               name: "RHBZ#2354811",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2354811",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-03-25T11:13:18.903000+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2025-03-25T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Tempo-operator: serviceaccount token exposure leading to token and subject access reviews in openshift tempo operator",
         workarounds: [
            {
               lang: "en",
               value: "Currently, no mitigation is available for this vulnerability.",
            },
         ],
         x_redhatCweChain: "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2025-2786",
      datePublished: "2025-04-02T11:07:43.285Z",
      dateReserved: "2025-03-25T10:51:16.783Z",
      dateUpdated: "2025-04-02T13:53:48.875Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-5037",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-07-13T20:15:59.404791Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-07-13T20:16:05.375Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-01T21:03:10.506Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2024:4151",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:4151",
               },
               {
                  name: "RHSA-2024:4156",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:4156",
               },
               {
                  name: "RHSA-2024:4329",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:4329",
               },
               {
                  name: "RHSA-2024:4484",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:4484",
               },
               {
                  tags: [
                     "vdb-entry",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2024-5037",
               },
               {
                  name: "RHBZ#2272339",
                  tags: [
                     "issue-tracking",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2272339",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/kubernetes/kubernetes/pull/123540",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/openshift/telemeter/blob/a9417a6062c3a31ed78c06ea3a0613a52f2029b2/pkg/authorize/jwt/client_authorizer.go#L78",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://github.com/openshift/telemeter",
               defaultStatus: "unaffected",
               packageName: "telemeter",
               versions: [
                  {
                     lessThan: "4.17",
                     status: "affected",
                     version: "4.16",
                     versionType: "semver",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift:4.12::el8",
                  "cpe:/a:redhat:openshift:4.12::el9",
               ],
               defaultStatus: "affected",
               packageName: "openshift4/ose-telemeter",
               product: "Red Hat OpenShift Container Platform 4.12",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "v4.12.0-202408071159.p0.gc9592de.assembly.stream.el8",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift:4.13::el8",
                  "cpe:/a:redhat:openshift:4.13::el9",
               ],
               defaultStatus: "affected",
               packageName: "openshift4/ose-telemeter",
               product: "Red Hat OpenShift Container Platform 4.13",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "v4.13.0-202407081338.p0.g0634a6d.assembly.stream.el8",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift:4.14::el9",
                  "cpe:/a:redhat:openshift:4.14::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift4/ose-telemeter",
               product: "Red Hat OpenShift Container Platform 4.14",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "v4.14.0-202407021509.p0.g1f72681.assembly.stream.el8",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift:4.15::el9",
                  "cpe:/a:redhat:openshift:4.15::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift4/ose-telemeter-rhel9",
               product: "Red Hat OpenShift Container Platform 4.15",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "v4.15.0-202406200537.p0.g14489f7.assembly.stream.el9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift:4.16::el9",
               ],
               defaultStatus: "affected",
               packageName: "openshift4/ose-telemeter-rhel9",
               product: "Red Hat OpenShift Container Platform 4.16",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "v4.16.0-202406200537.p0.gc1ecd10.assembly.stream.el9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:logging:5",
               ],
               defaultStatus: "unaffected",
               packageName: "openshift-logging/opa-openshift-rhel8",
               product: "Logging Subsystem for Red Hat OpenShift",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:2",
               ],
               defaultStatus: "affected",
               packageName: "rhosdt/tempo-gateway-opa-rhel8",
               product: "Red Hat OpenShift distributed tracing 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "affected",
               packageName: "rhosdt/tempo-gateway-opa-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2024-06-05T17:51:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue (\"iss\") check during JSON web token (JWT) authentication.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Important",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-290",
                     description: "Authentication Bypass by Spoofing",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-02-06T08:30:19.750Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2024:4151",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:4151",
            },
            {
               name: "RHSA-2024:4156",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:4156",
            },
            {
               name: "RHSA-2024:4329",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:4329",
            },
            {
               name: "RHSA-2024:4484",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:4484",
            },
            {
               name: "RHSA-2024:5200",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:5200",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2024-5037",
            },
            {
               name: "RHBZ#2272339",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2272339",
            },
            {
               url: "https://github.com/kubernetes/kubernetes/pull/123540",
            },
            {
               url: "https://github.com/openshift/telemeter/blob/a9417a6062c3a31ed78c06ea3a0613a52f2029b2/pkg/authorize/jwt/client_authorizer.go#L78",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2024-03-30T00:00:00+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2024-06-05T17:51:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Openshift/telemeter: iss check during jwt authentication can be bypassed",
         x_redhatCweChain: "CWE-290: Authentication Bypass by Spoofing",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2024-5037",
      datePublished: "2024-06-05T18:03:23.194Z",
      dateReserved: "2024-05-16T22:03:32.375Z",
      dateUpdated: "2025-02-06T08:30:19.750Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-11831",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-10T17:08:31.160473Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-10T17:08:44.112Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://github.com/yahoo/serialize-javascript",
               packageName: "serialize-javascript",
               versions: [
                  {
                     lessThan: "6.0.2",
                     status: "affected",
                     version: "6.0",
                     versionType: "semver",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:advanced_cluster_security:4.4::el8",
               ],
               defaultStatus: "affected",
               packageName: "advanced-cluster-security/rhacs-main-rhel8",
               product: "Red Hat Advanced Cluster Security 4.4",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "4.4.8-2",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:advanced_cluster_security:4.5::el8",
               ],
               defaultStatus: "affected",
               packageName: "advanced-cluster-security/rhacs-main-rhel8",
               product: "Red Hat Advanced Cluster Security 4.5",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "4.5.6-2",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:cryostat:3",
               ],
               defaultStatus: "affected",
               packageName: "serialize-javascript",
               product: "Cryostat 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:logging:5",
               ],
               defaultStatus: "affected",
               packageName: "openshift-logging/kibana6-rhel8",
               product: "Logging Subsystem for Red Hat OpenShift",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_applications:7",
               ],
               defaultStatus: "affected",
               packageName: "mta/mta-cli-rhel9",
               product: "Migration Toolkit for Applications 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_applications:7",
               ],
               defaultStatus: "affected",
               packageName: "mta/mta-ui-rhel9",
               product: "Migration Toolkit for Applications 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_virtualization:2",
               ],
               defaultStatus: "unaffected",
               packageName: "migration-toolkit-virtualization/mtv-console-plugin-rhel9",
               product: "Migration Toolkit for Virtualization",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_dotnet:6.0",
               ],
               defaultStatus: "affected",
               packageName: "rh-dotnet60-dotnet",
               product: ".NET 6.0 on Red Hat Enterprise Linux",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_lightspeed",
               ],
               defaultStatus: "affected",
               packageName: "openshift-lightspeed-beta/lightspeed-console-plugin-rhel9",
               product: "OpenShift Lightspeed",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_pipelines:1",
               ],
               defaultStatus: "affected",
               packageName: "openshift-pipelines-console-plugin-rhel8-container",
               product: "OpenShift Pipelines",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_pipelines:1",
               ],
               defaultStatus: "affected",
               packageName: "openshift-pipelines/pipelines-hub-api-rhel8",
               product: "OpenShift Pipelines",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_pipelines:1",
               ],
               defaultStatus: "affected",
               packageName: "openshift-pipelines/pipelines-hub-db-migration-rhel8",
               product: "OpenShift Pipelines",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_pipelines:1",
               ],
               defaultStatus: "affected",
               packageName: "openshift-pipelines/pipelines-hub-ui-rhel8",
               product: "OpenShift Pipelines",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:serverless:1",
               ],
               defaultStatus: "affected",
               packageName: "serialize-javascript",
               product: "OpenShift Serverless",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:service_mesh:2",
               ],
               defaultStatus: "affected",
               packageName: "openshift-service-mesh/kiali-ossmc-rhel8",
               product: "OpenShift Service Mesh 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:service_mesh:2",
               ],
               defaultStatus: "affected",
               packageName: "openshift-service-mesh/kiali-rhel8",
               product: "OpenShift Service Mesh 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:red_hat_3scale_amp:2",
               ],
               defaultStatus: "affected",
               packageName: "3scale-amp-system-container",
               product: "Red Hat 3scale API Management Platform 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:acm:2",
               ],
               defaultStatus: "unaffected",
               packageName: "rhacm2/console-rhel8",
               product: "Red Hat Advanced Cluster Management for Kubernetes 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:advanced_cluster_security:4",
               ],
               defaultStatus: "unaffected",
               packageName: "advanced-cluster-security/rhacs-central-db-rhel8",
               product: "Red Hat Advanced Cluster Security 4",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:advanced_cluster_security:4",
               ],
               defaultStatus: "unaffected",
               packageName: "advanced-cluster-security/rhacs-rhel8-operator",
               product: "Red Hat Advanced Cluster Security 4",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:advanced_cluster_security:4",
               ],
               defaultStatus: "unaffected",
               packageName: "advanced-cluster-security/rhacs-roxctl-rhel8",
               product: "Red Hat Advanced Cluster Security 4",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:advanced_cluster_security:4",
               ],
               defaultStatus: "unaffected",
               packageName: "advanced-cluster-security/rhacs-scanner-v4-db-rhel8",
               product: "Red Hat Advanced Cluster Security 4",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:advanced_cluster_security:4",
               ],
               defaultStatus: "unaffected",
               packageName: "advanced-cluster-security/rhacs-scanner-v4-rhel8",
               product: "Red Hat Advanced Cluster Security 4",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:ansible_automation_platform:2",
               ],
               defaultStatus: "affected",
               packageName: "aap-cloud-ui-container",
               product: "Red Hat Ansible Automation Platform 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:ansible_automation_platform:2",
               ],
               defaultStatus: "affected",
               packageName: "ansible-automation-platform-24/lightspeed-rhel8",
               product: "Red Hat Ansible Automation Platform 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:ansible_automation_platform:2",
               ],
               defaultStatus: "unaffected",
               packageName: "automation-controller",
               product: "Red Hat Ansible Automation Platform 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:ansible_automation_platform:2",
               ],
               defaultStatus: "affected",
               packageName: "automation-eda-controller",
               product: "Red Hat Ansible Automation Platform 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhboac_hawtio:4",
               ],
               defaultStatus: "affected",
               packageName: "serialize-javascript",
               product: "Red Hat build of Apache Camel - HawtIO 4",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:service_registry:2",
               ],
               defaultStatus: "affected",
               packageName: "serialize-javascript",
               product: "Red Hat build of Apicurio Registry 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:",
               ],
               defaultStatus: "affected",
               packageName: "serialize-javascript",
               product: "Red Hat Build of Keycloak",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:optaplanner:::el6",
               ],
               defaultStatus: "affected",
               packageName: "serialize-javascript",
               product: "Red Hat build of OptaPlanner 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:8",
               ],
               defaultStatus: "affected",
               packageName: "serialize-javascript",
               product: "Red Hat Data Grid 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:rhdh:1",
               ],
               defaultStatus: "affected",
               packageName: "rhdh-operator-container",
               product: "Red Hat Developer Hub",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhdh:1",
               ],
               defaultStatus: "affected",
               packageName: "rhdh/rhdh-hub-rhel9",
               product: "Red Hat Developer Hub",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:discovery:1",
               ],
               defaultStatus: "affected",
               packageName: "discovery-server-container",
               product: "Red Hat Discovery",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "affected",
               packageName: "dotnet6.0",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "affected",
               packageName: "dotnet8.0",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "affected",
               packageName: "grafana",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "pcs",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "dotnet6.0",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "dotnet7.0",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "dotnet8.0",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "unaffected",
               packageName: "pcs",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:7",
               ],
               defaultStatus: "affected",
               packageName: "serialize-javascript",
               product: "Red Hat Fuse 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:integration:1",
               ],
               defaultStatus: "unaffected",
               packageName: "serialize-javascript",
               product: "Red Hat Integration Camel K 1",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7",
               ],
               defaultStatus: "unaffected",
               packageName: "serialize-javascript",
               product: "Red Hat JBoss Enterprise Application Platform 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8",
               ],
               defaultStatus: "unaffected",
               packageName: "serialize-javascript",
               product: "Red Hat JBoss Enterprise Application Platform 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jbosseapxp",
               ],
               defaultStatus: "unaffected",
               packageName: "serialize-javascript",
               product: "Red Hat JBoss Enterprise Application Platform Expansion Pack",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_ai",
               ],
               defaultStatus: "unaffected",
               packageName: "odh-dashboard-container",
               product: "Red Hat OpenShift AI (RHOAI)",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_ai",
               ],
               defaultStatus: "affected",
               packageName: "odh-dashboard-rhel8",
               product: "Red Hat OpenShift AI (RHOAI)",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_ai",
               ],
               defaultStatus: "affected",
               packageName: "odh-data-science-pipelines-argo-argoexec-rhel8",
               product: "Red Hat OpenShift AI (RHOAI)",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_ai",
               ],
               defaultStatus: "affected",
               packageName: "odh-data-science-pipelines-argo-workflowcontroller-rhel8",
               product: "Red Hat OpenShift AI (RHOAI)",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_ai",
               ],
               defaultStatus: "affected",
               packageName: "odh-kf-notebook-controller-rhel8",
               product: "Red Hat OpenShift AI (RHOAI)",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_ai",
               ],
               defaultStatus: "affected",
               packageName: "odh-ml-pipelines-api-server-v2-rhel8",
               product: "Red Hat OpenShift AI (RHOAI)",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_ai",
               ],
               defaultStatus: "affected",
               packageName: "odh-ml-pipelines-driver-rhel8",
               product: "Red Hat OpenShift AI (RHOAI)",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_ai",
               ],
               defaultStatus: "affected",
               packageName: "odh-ml-pipelines-launcher-rhel8",
               product: "Red Hat OpenShift AI (RHOAI)",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_ai",
               ],
               defaultStatus: "affected",
               packageName: "odh-ml-pipelines-persistenceagent-v2-rhel8",
               product: "Red Hat OpenShift AI (RHOAI)",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_ai",
               ],
               defaultStatus: "affected",
               packageName: "odh-ml-pipelines-scheduledworkflow-v2-rhel8",
               product: "Red Hat OpenShift AI (RHOAI)",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_ai",
               ],
               defaultStatus: "affected",
               packageName: "odh-model-registry-rhel8",
               product: "Red Hat OpenShift AI (RHOAI)",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_ai",
               ],
               defaultStatus: "unaffected",
               packageName: "odh-notebook-controller-rhel8",
               product: "Red Hat OpenShift AI (RHOAI)",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_ai",
               ],
               defaultStatus: "unaffected",
               packageName: "odh-operator-container",
               product: "Red Hat OpenShift AI (RHOAI)",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift:3.11",
               ],
               defaultStatus: "affected",
               packageName: "openshift3/ose-console",
               product: "Red Hat OpenShift Container Platform 3.11",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift:4",
               ],
               defaultStatus: "unaffected",
               packageName: "openshift4/ose-monitoring-plugin-rhel9",
               product: "Red Hat OpenShift Container Platform 4",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_data_foundation:4",
               ],
               defaultStatus: "affected",
               packageName: "odf4/mcg-core-rhel8",
               product: "Red Hat Openshift Data Foundation 4",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_data_foundation:4",
               ],
               defaultStatus: "affected",
               packageName: "odf4/ocs-client-console-rhel9",
               product: "Red Hat Openshift Data Foundation 4",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_data_foundation:4",
               ],
               defaultStatus: "affected",
               packageName: "odf4/odf-console-rhel9",
               product: "Red Hat Openshift Data Foundation 4",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_data_foundation:4",
               ],
               defaultStatus: "affected",
               packageName: "odf4/odf-multicluster-console-rhel8",
               product: "Red Hat Openshift Data Foundation 4",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_devspaces:3:",
               ],
               defaultStatus: "affected",
               packageName: "devspaces/code-rhel8",
               product: "Red Hat OpenShift Dev Spaces",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_devspaces:3:",
               ],
               defaultStatus: "affected",
               packageName: "devspaces/dashboard-rhel8",
               product: "Red Hat OpenShift Dev Spaces",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_devspaces:3:",
               ],
               defaultStatus: "affected",
               packageName: "devspaces/traefik-rhel8",
               product: "Red Hat OpenShift Dev Spaces",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "unaffected",
               packageName: "rhosdt/jaeger-agent-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "affected",
               packageName: "rhosdt/jaeger-all-in-one-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "unaffected",
               packageName: "rhosdt/jaeger-collector-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "unaffected",
               packageName: "rhosdt/jaeger-es-index-cleaner-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "unaffected",
               packageName: "rhosdt/jaeger-es-rollover-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "unaffected",
               packageName: "rhosdt/jaeger-ingester-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "affected",
               packageName: "rhosdt/jaeger-query-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:7",
               ],
               defaultStatus: "affected",
               packageName: "serialize-javascript",
               product: "Red Hat Process Automation 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:quay:3",
               ],
               defaultStatus: "affected",
               packageName: "quay/quay-rhel8",
               product: "Red Hat Quay 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:satellite:6",
               ],
               defaultStatus: "affected",
               packageName: "nodejs-compression-webpack-plugin",
               product: "Red Hat Satellite 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:satellite:6",
               ],
               defaultStatus: "affected",
               packageName: "nodejs-css-minimizer-webpack-plugin",
               product: "Red Hat Satellite 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:satellite:6",
               ],
               defaultStatus: "affected",
               packageName: "nodejs-uglifyjs-webpack-plugin",
               product: "Red Hat Satellite 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:satellite:6",
               ],
               defaultStatus: "affected",
               packageName: "nodejs-webpack",
               product: "Red Hat Satellite 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7",
               ],
               defaultStatus: "affected",
               packageName: "serialize-javascript",
               product: "Red Hat Single Sign-On 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:trusted_profile_analyzer:1",
               ],
               defaultStatus: "affected",
               packageName: "rhtpa/rhtpa-trustification-service-rhel9",
               product: "Red Hat Trusted Profile Analyzer",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2024-09-16T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Moderate",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-79",
                     description: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-31T18:33:07.877Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2025:1334",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:1334",
            },
            {
               name: "RHSA-2025:1468",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:1468",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2024-11831",
            },
            {
               name: "RHBZ#2312579",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2312579",
            },
            {
               url: "https://github.com/yahoo/serialize-javascript/commit/f27d65d3de42affe2aac14607066c293891cec4e",
            },
            {
               url: "https://github.com/yahoo/serialize-javascript/pull/173",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2024-09-16T16:43:32.021000+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2024-09-16T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript",
         workarounds: [
            {
               lang: "en",
               value: "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
            },
         ],
         x_redhatCweChain: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2024-11831",
      datePublished: "2025-02-10T15:27:46.732Z",
      dateReserved: "2024-11-26T18:56:38.187Z",
      dateUpdated: "2025-03-31T18:33:07.877Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-2842",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-02T13:12:50.601180Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-02T13:25:51.661Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "affected",
               packageName: "rhosdt/tempo-gateway-opa-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "affected",
               packageName: "rhosdt/tempo-gateway-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "affected",
               packageName: "rhosdt/tempo-jaeger-query-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "affected",
               packageName: "rhosdt/tempo-query-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "affected",
               packageName: "rhosdt/tempo-rhel8",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_distributed_tracing:3",
               ],
               defaultStatus: "affected",
               packageName: "rhosdt/tempo-rhel8-operator",
               product: "Red Hat OpenShift distributed tracing 3",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2025-03-27T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole.\nThis can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Moderate",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "Exposure of Sensitive Information to an Unauthorized Actor",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-04-02T11:09:55.496Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2025-2842",
            },
            {
               name: "RHBZ#2355219",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2355219",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-03-27T02:33:13.059000+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2025-03-27T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Tempo-operator: tempo operator token exposition lead to read sensitive data",
         workarounds: [
            {
               lang: "en",
               value: "Currently, no mitigation is available for this vulnerability.",
            },
         ],
         x_redhatCweChain: "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2025-2842",
      datePublished: "2025-04-02T11:09:55.496Z",
      dateReserved: "2025-03-27T02:38:55.497Z",
      dateUpdated: "2025-04-02T13:25:51.661Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}