Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-29063 (GCVE-0-2026-29063)
Vulnerability from cvelistv5 – Published: 2026-03-06 18:25 – Updated: 2026-07-02 12:04
VLAI
EPSS
Title
Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
Summary
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
59 references
Impacted products
64 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-29063",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-06T19:32:37.694711Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T19:33:31.642Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"cpes": [
"cpe:/a:redhat:cluster_observability_operator:1.5::el9"
],
"defaultStatus": "affected",
"product": "Cluster Observability Operator 1.5.0",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:migration_toolkit_virtualization:2.10::el9"
],
"defaultStatus": "affected",
"product": "Migration Toolkit for Virtualization 2.1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:migration_toolkit_virtualization:2.9::el9"
],
"defaultStatus": "affected",
"product": "Migration Toolkit for Virtualization 2.9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:network_observ_optr:1.11::el9"
],
"defaultStatus": "affected",
"product": "Network Observability (NETOBSERV) 1.11.2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:network_observ_optr:1.12::el9"
],
"defaultStatus": "affected",
"product": "Network Observability (NETOBSERV) 1.12.0",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:acm:2.15::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:acm:2.16::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.10::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Security for Kubernetes 4.10",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.8::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Security for Kubernetes 4.8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.9::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Security for Kubernetes 4.9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhdh:1.8::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Developer Hub 1.8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhdh:1.9::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Developer Hub 1.9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:discovery:2::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Discovery 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.14::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.14",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.15::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.15",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.16::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.16",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.17::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.17",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.18::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.18",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.19::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.19",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.20::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.20",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.21::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.21",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_pipelines:1.20::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Pipelines 1.2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:2.6::el8"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 2.6",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3.0::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 3.0",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3.1::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 3.1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3.2::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 3.2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3.3::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 3.3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.10::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.10",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.12::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.12",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.15::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.15",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.16::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.16",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.17::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.17",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.9::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:satellite:6.18::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Satellite 6.18",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.10::el9"
],
"defaultStatus": "affected",
"product": "multicluster engine for Kubernetes 2.10",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.11::el9"
],
"defaultStatus": "affected",
"product": "multicluster engine for Kubernetes 2.11",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.6::el9"
],
"defaultStatus": "affected",
"product": "multicluster engine for Kubernetes 2.6",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.7::el9"
],
"defaultStatus": "affected",
"product": "multicluster engine for Kubernetes 2.7",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.8::el9"
],
"defaultStatus": "affected",
"product": "multicluster engine for Kubernetes 2.8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.9::el9"
],
"defaultStatus": "affected",
"product": "multicluster engine for Kubernetes 2.9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "affected",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhmt:1"
],
"defaultStatus": "affected",
"product": "Migration Toolkit for Containers",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:workload_availability_nhc:0"
],
"defaultStatus": "affected",
"product": "Node HealthCheck Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_lightspeed"
],
"defaultStatus": "affected",
"product": "OpenShift Lightspeed",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_pipelines:1"
],
"defaultStatus": "affected",
"product": "OpenShift Pipelines",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_registry:2"
],
"defaultStatus": "affected",
"product": "Red Hat build of Apicurio Registry 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:connectivity_link:1"
],
"defaultStatus": "affected",
"product": "Red Hat Connectivity Link 1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:edge_manager:1"
],
"defaultStatus": "affected",
"product": "Red Hat Edge Manager 1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "affected",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_gitops:1"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift GitOps",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Virtualization 4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "affected",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ansible_portal:2"
],
"defaultStatus": "affected",
"product": "Self-service automation portal 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3"
],
"defaultStatus": "unaffected",
"product": "OpenShift Service Mesh 3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
}
],
"datePublic": "2026-03-06T18:25:22.438Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-02T12:04:49.685Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"name": "RHBZ#2445291",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29063.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34342"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19409"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19410"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6428"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24473"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13548"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13847"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13829"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11070"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11217"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13791"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13826"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7329"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24977"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19712"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28893"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28964"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20088"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17598"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21658"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29857"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21657"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:12118"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20042"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29864"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23246"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20041"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17469"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27063"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21703"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20034"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21931"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8483"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8484"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8490"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11916"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6720"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6568"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19375"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22465"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26232"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26225"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13542"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13853"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9848"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11858"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8218"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11414"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:34342: Cluster Observability Operator 1.5.0"
},
{
"lang": "en",
"value": "RHSA-2026:19409: Migration Toolkit for Virtualization 2.1"
},
{
"lang": "en",
"value": "RHSA-2026:19410: Migration Toolkit for Virtualization 2.9"
},
{
"lang": "en",
"value": "RHSA-2026:6428: Network Observability (NETOBSERV) 1.11.2"
},
{
"lang": "en",
"value": "RHSA-2026:24473: Network Observability (NETOBSERV) 1.12.0"
},
{
"lang": "en",
"value": "RHSA-2026:13548: Red Hat Advanced Cluster Management for Kubernetes 2.15"
},
{
"lang": "en",
"value": "RHSA-2026:13847: Red Hat Advanced Cluster Management for Kubernetes 2.16"
},
{
"lang": "en",
"value": "RHSA-2026:13829: Red Hat Advanced Cluster Security for Kubernetes 4.10"
},
{
"lang": "en",
"value": "RHSA-2026:11070: Red Hat Advanced Cluster Security for Kubernetes 4.8"
},
{
"lang": "en",
"value": "RHSA-2026:11217: Red Hat Advanced Cluster Security for Kubernetes 4.8"
},
{
"lang": "en",
"value": "RHSA-2026:13791: Red Hat Advanced Cluster Security for Kubernetes 4.9"
},
{
"lang": "en",
"value": "RHSA-2026:9742: Red Hat Developer Hub 1.8"
},
{
"lang": "en",
"value": "RHSA-2026:13826: Red Hat Developer Hub 1.9"
},
{
"lang": "en",
"value": "RHSA-2026:7329: Red Hat Discovery 2"
},
{
"lang": "en",
"value": "RHSA-2026:24977: Red Hat OpenShift AI 2.25"
},
{
"lang": "en",
"value": "RHSA-2026:19712: Red Hat OpenShift AI 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:28893: Red Hat OpenShift Container Platform 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:28964: Red Hat OpenShift Container Platform 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:20088: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:17598: Red Hat OpenShift Container Platform 4.17"
},
{
"lang": "en",
"value": "RHSA-2026:21658: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:29857: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:21657: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:12118: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:20042: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:29864: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:23246: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:20041: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:17469: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:27063: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:21703: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:20034: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:21931: Red Hat OpenShift Pipelines 1.2"
},
{
"lang": "en",
"value": "RHSA-2026:8483: Red Hat OpenShift Service Mesh 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:8484: Red Hat OpenShift Service Mesh 3.0"
},
{
"lang": "en",
"value": "RHSA-2026:8490: Red Hat OpenShift Service Mesh 3.1"
},
{
"lang": "en",
"value": "RHSA-2026:8491: Red Hat OpenShift Service Mesh 3.2"
},
{
"lang": "en",
"value": "RHSA-2026:8493: Red Hat OpenShift Service Mesh 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:11916: Red Hat Quay 3.10"
},
{
"lang": "en",
"value": "RHSA-2026:6720: Red Hat Quay 3.12"
},
{
"lang": "en",
"value": "RHSA-2026:6568: Red Hat Quay 3.15"
},
{
"lang": "en",
"value": "RHSA-2026:19375: Red Hat Quay 3.16"
},
{
"lang": "en",
"value": "RHSA-2026:22465: Red Hat Quay 3.17"
},
{
"lang": "en",
"value": "RHSA-2026:6926: Red Hat Quay 3.9"
},
{
"lang": "en",
"value": "RHSA-2026:26232: Red Hat Satellite 6.18"
},
{
"lang": "en",
"value": "RHSA-2026:26225: Red Hat Satellite 6.18"
},
{
"lang": "en",
"value": "RHSA-2026:13542: multicluster engine for Kubernetes 2.10"
},
{
"lang": "en",
"value": "RHSA-2026:13853: multicluster engine for Kubernetes 2.11"
},
{
"lang": "en",
"value": "RHSA-2026:9848: multicluster engine for Kubernetes 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:11858: multicluster engine for Kubernetes 2.7"
},
{
"lang": "en",
"value": "RHSA-2026:8218: multicluster engine for Kubernetes 2.8"
},
{
"lang": "en",
"value": "RHSA-2026:11414: multicluster engine for Kubernetes 2.9"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-06T19:00:57.982Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-03-06T18:25:22.438Z",
"value": "Made public."
}
],
"title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "immutable-js",
"vendor": "immutable-js",
"versions": [
{
"status": "affected",
"version": "\u003c 3.8.3"
},
{
"status": "affected",
"version": "\u003c 4.3.7"
},
{
"status": "affected",
"version": "\u003c 5.1.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T18:25:22.438Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
},
{
"name": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
},
{
"name": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
},
{
"name": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
}
],
"source": {
"advisory": "GHSA-wf6x-7x77-mvgw",
"discovery": "UNKNOWN"
},
"title": "Immutable.js: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027) in immutable"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-29063",
"datePublished": "2026-03-06T18:25:22.438Z",
"dateReserved": "2026-03-03T20:51:43.481Z",
"dateUpdated": "2026-07-02T12:04:49.685Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-29063",
"date": "2026-07-02",
"epss": "0.00978",
"percentile": "0.57833"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-29063\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-06T19:16:21.557\",\"lastModified\":\"2026-07-02T12:17:01.480\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.\"},{\"lang\":\"es\",\"value\":\"Immutable.js proporciona muchas estructuras de datos inmutables persistentes. Antes de las versiones 3.8.3, 4.3.7 y 5.1.5, la contaminaci\u00f3n de prototipos es posible en immutable a trav\u00e9s de las APIs mergeDeep(), mergeDeepWith(), merge(), Map.toJS() y Map.toObject(). Este problema ha sido parcheado en las versiones 3.8.3, 4.3.7 y 5.1.5.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"immutable-js\",\"product\":\"immutable-js\",\"versions\":[{\"version\":\"\u003c 3.8.3\",\"status\":\"affected\"},{\"version\":\"\u003c 4.3.7\",\"status\":\"affected\"},{\"version\":\"\u003c 5.1.5\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Cluster Observability Operator 1.5.0\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:cluster_observability_operator:1.5::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Migration Toolkit for Virtualization 2.1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:migration_toolkit_virtualization:2.10::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Migration Toolkit for Virtualization 2.9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:migration_toolkit_virtualization:2.9::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Network Observability (NETOBSERV) 1.11.2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:network_observ_optr:1.11::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Network Observability (NETOBSERV) 1.12.0\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:network_observ_optr:1.12::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2.15\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:acm:2.15::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2.16\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:acm:2.16::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security for Kubernetes 4.10\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.10::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security for Kubernetes 4.8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.8::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security for Kubernetes 4.9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.9::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Developer Hub 1.8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhdh:1.8::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Developer Hub 1.9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhdh:1.9::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Discovery 2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:discovery:2::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.14\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.14::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.15\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.15::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.16\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.16::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.17\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.17::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.18\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.18::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.19\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.19::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.20\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.20::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.21\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.21::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Pipelines 1.2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_pipelines:1.20::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 2.6\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:2.6::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.0\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.0::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.2::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.3::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.10\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.10::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.12\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.12::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.15\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.15::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.16\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.16::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.17\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.17::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.9::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.18\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:satellite:6.18::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.10\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.10::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.11\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.11::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.6\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.6::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.7\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.7::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.8::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.9::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:logging:5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Migration Toolkit for Containers\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhmt:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Node HealthCheck Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:workload_availability_nhc:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Lightspeed\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_lightspeed\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Pipelines\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_pipelines:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_registry:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Connectivity Link 1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:connectivity_link:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Edge Manager 1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:edge_manager:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Virtualization 4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Self-service automation portal 2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ansible_portal:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Service Mesh 3\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-03-06T19:32:37.694711Z\",\"id\":\"CVE-2026-29063\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1321\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-915\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:immutable-js:immutable:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"3.0.0\",\"versionEndExcluding\":\"3.8.3\",\"matchCriteriaId\":\"22FDF10C-08DC-4178-9F7C-D580C292885A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:immutable-js:immutable:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndExcluding\":\"4.3.7\",\"matchCriteriaId\":\"A0F2EC71-7029-4F13-B383-6018587EE882\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:immutable-js:immutable:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"5.0.0\",\"versionEndExcluding\":\"5.1.5\",\"matchCriteriaId\":\"17E6FB8C-0F81-4EA4-B197-C08AB22253C3\"}]}]}],\"references\":[{\"url\":\"https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11070\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11217\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11414\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11858\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11916\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:12118\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13542\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13548\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13791\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13826\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13829\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13847\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13853\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17469\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17598\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19375\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19409\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19410\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19712\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20034\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20041\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20042\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20088\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21657\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21658\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21703\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21931\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22465\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23246\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24473\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24977\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26225\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26232\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27063\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28893\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28964\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29857\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29864\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34342\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6428\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6568\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6720\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6926\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7329\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8218\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8483\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8484\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8490\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8491\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8493\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9742\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9848\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-29063\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2445291\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29063.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:cluster_observability_operator:1.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Cluster Observability Operator 1.5.0\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:migration_toolkit_virtualization:2.10::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Migration Toolkit for Virtualization 2.1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:migration_toolkit_virtualization:2.9::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Migration Toolkit for Virtualization 2.9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:network_observ_optr:1.11::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Network Observability (NETOBSERV) 1.11.2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:network_observ_optr:1.12::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Network Observability (NETOBSERV) 1.12.0\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2.15::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.15\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.16\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.10::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security for Kubernetes 4.10\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.8::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security for Kubernetes 4.8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security for Kubernetes 4.9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhdh:1.8::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Developer Hub 1.8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhdh:1.9::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Developer Hub 1.9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:discovery:2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Discovery 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.14::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.14\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.15::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.15\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.16\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.17\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.18\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.19\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.20\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.21::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.21\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_pipelines:1.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Pipelines 1.2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:2.6::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 2.6\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.0\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.10::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.10\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.12::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.12\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.15::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.15\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.16\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.17\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.18\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.10::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.10\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.11::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.11\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.6\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.7::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.7\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.8::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.9::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:5\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhmt:1\"], \"vendor\": \"Red Hat\", \"product\": \"Migration Toolkit for Containers\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_nhc:0\"], \"vendor\": \"Red Hat\", \"product\": \"Node HealthCheck Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_lightspeed\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Lightspeed\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_pipelines:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Pipelines\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_registry:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:connectivity_link:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Connectivity Link 1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:edge_manager:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Edge Manager 1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Virtualization 4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_portal:2\"], \"vendor\": \"Red Hat\", \"product\": \"Self-service automation portal 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Service Mesh 3\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-03-06T19:00:57.982Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-03-06T18:25:22.438Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:34342: Cluster Observability Operator 1.5.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19409: Migration Toolkit for Virtualization 2.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19410: Migration Toolkit for Virtualization 2.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6428: Network Observability (NETOBSERV) 1.11.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24473: Network Observability (NETOBSERV) 1.12.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13548: Red Hat Advanced Cluster Management for Kubernetes 2.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13847: Red Hat Advanced Cluster Management for Kubernetes 2.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13829: Red Hat Advanced Cluster Security for Kubernetes 4.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11070: Red Hat Advanced Cluster Security for Kubernetes 4.8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11217: Red Hat Advanced Cluster Security for Kubernetes 4.8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13791: Red Hat Advanced Cluster Security for Kubernetes 4.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9742: Red Hat Developer Hub 1.8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13826: Red Hat Developer Hub 1.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7329: Red Hat Discovery 2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24977: Red Hat OpenShift AI 2.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19712: Red Hat OpenShift AI 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28893: Red Hat OpenShift Container Platform 4.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28964: Red Hat OpenShift Container Platform 4.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20088: Red Hat OpenShift Container Platform 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17598: Red Hat OpenShift Container Platform 4.17\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21658: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:29857: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21657: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:12118: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20042: Red Hat OpenShift Container Platform 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:29864: Red Hat OpenShift Container Platform 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23246: Red Hat OpenShift Container Platform 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20041: Red Hat OpenShift Container Platform 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17469: Red Hat OpenShift Container Platform 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:27063: Red Hat OpenShift Container Platform 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21703: Red Hat OpenShift Container Platform 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20034: Red Hat OpenShift Container Platform 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21931: Red Hat OpenShift Pipelines 1.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8483: Red Hat OpenShift Service Mesh 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8484: Red Hat OpenShift Service Mesh 3.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8490: Red Hat OpenShift Service Mesh 3.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8491: Red Hat OpenShift Service Mesh 3.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8493: Red Hat OpenShift Service Mesh 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11916: Red Hat Quay 3.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6720: Red Hat Quay 3.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6568: Red Hat Quay 3.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19375: Red Hat Quay 3.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22465: Red Hat Quay 3.17\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6926: Red Hat Quay 3.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26232: Red Hat Satellite 6.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26225: Red Hat Satellite 6.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13542: multicluster engine for Kubernetes 2.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13853: multicluster engine for Kubernetes 2.11\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9848: multicluster engine for Kubernetes 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11858: multicluster engine for Kubernetes 2.7\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8218: multicluster engine for Kubernetes 2.8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11414: multicluster engine for Kubernetes 2.9\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-03-06T18:25:22.438Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-29063\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2445291\", \"name\": \"RHBZ#2445291\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29063.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34342\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19409\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19410\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6428\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24473\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13548\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13847\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13829\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11070\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11217\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13791\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9742\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13826\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7329\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24977\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19712\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28893\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28964\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20088\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17598\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21658\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29857\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21657\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:12118\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20042\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29864\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23246\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20041\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17469\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27063\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21703\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20034\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21931\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8483\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8484\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8490\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8491\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8493\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11916\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6720\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6568\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19375\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22465\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6926\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26232\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26225\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13542\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13853\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9848\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11858\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8218\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11414\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-915\", \"description\": \"Improperly Controlled Modification of Dynamically-Determined Object Attributes\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-07-02T12:04:49.685Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-29063\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-06T19:32:37.694711Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-06T19:32:46.434Z\"}}], \"cna\": {\"title\": \"Immutable.js: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027) in immutable\", \"source\": {\"advisory\": \"GHSA-wf6x-7x77-mvgw\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"immutable-js\", \"product\": \"immutable-js\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.8.3\"}, {\"status\": \"affected\", \"version\": \"\u003c 4.3.7\"}, {\"status\": \"affected\", \"version\": \"\u003c 5.1.5\"}]}], \"references\": [{\"url\": \"https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw\", \"name\": \"https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3\", \"name\": \"https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8\", \"name\": \"https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5\", \"name\": \"https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1321\", \"description\": \"CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-06T18:25:22.438Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-29063\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-02T12:04:49.685Z\", \"dateReserved\": \"2026-03-03T20:51:43.481Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-06T18:25:22.438Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:6720
Vulnerability from csaf_redhat - Published: 2026-04-06 22:57 - Updated: 2026-07-02 13:42Summary
Red Hat Security Advisory: Red Hat Quay 3.12.16
Severity
Important
Notes
Topic: Red Hat Quay 3.12.16 is now available with bug fixes.
Details: Quay 3.12.16
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jsrsasign. A remote attacker could exploit this vulnerability by providing specially crafted zero or negative inputs to the bnModInverse function within the BigInteger.modInverse implementation. This could lead to an infinite loop, causing a permanent denial of service (DoS) by hanging the process.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. An attacker can exploit an incomplete comparison vulnerability in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. By manipulating incorrect comparison checks, an attacker can bias the Digital Signature Algorithm (DSA) nonces during signature generation. This allows the attacker to recover the private key, leading to a critical security compromise.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. An attacker can exploit improper verification of cryptographic signatures by supplying malicious domain parameters during the Digital Signature Algorithm (DSA) validation process. This allows the attacker to forge DSA signatures or X.509 certificates, which would then be accepted as legitimate, potentially leading to unauthorized access or data manipulation.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. An attacker can exploit a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process, specifically within the KJUR.crypto.DSA.signWithMessageHash function. By manipulating the signature generation to force specific values, the library emits an invalid signature without retrying. This vulnerability allows an attacker to recover the private key used for signing.
8.7 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. A remote attacker can exploit an incorrect conversion between numeric types by providing a negative exponent to the `modPow` function. This vulnerability can force the computation of incorrect modular inverses, which ultimately allows an attacker to bypass signature verification.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64 | — |
Workaround
|
Threats
Impact
Important
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Authlib, a Python library used for building OAuth and OpenID Connect (OIDC) servers. This vulnerability allows a remote attacker to bypass critical integrity checks in OIDC ID Tokens. Specifically, the library's internal hash verification logic fails open when encountering an unsupported cryptographic algorithm, accepting a forged ID Token as valid. This can lead to an authentication bypass, granting unauthorized access to systems relying on Authlib for OIDC authentication.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le | — |
Vendor Fix
fix
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64 | — |
Threats
Impact
Important
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le | — |
Vendor Fix
fix
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64 | — |
Threats
Impact
Important
An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64 | — |
Workaround
|
Threats
Impact
Important
A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64 | — |
Workaround
|
Threats
Impact
Important
References
87 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.12.16 is now available with bug fixes.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.12.16",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:6720",
"url": "https://access.redhat.com/errata/RHSA-2026:6720"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-28498",
"url": "https://access.redhat.com/security/cve/CVE-2026-28498"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29063",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-30922",
"url": "https://access.redhat.com/security/cve/CVE-2026-30922"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32597",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4598",
"url": "https://access.redhat.com/security/cve/CVE-2026-4598"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4599",
"url": "https://access.redhat.com/security/cve/CVE-2026-4599"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4600",
"url": "https://access.redhat.com/security/cve/CVE-2026-4600"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4601",
"url": "https://access.redhat.com/security/cve/CVE-2026-4601"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4602",
"url": "https://access.redhat.com/security/cve/CVE-2026-4602"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6720.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Quay 3.12.16",
"tracking": {
"current_release_date": "2026-07-02T13:42:01+00:00",
"generator": {
"date": "2026-07-02T13:42:01+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:6720",
"initial_release_date": "2026-04-06T22:57:46+00:00",
"revision_history": [
{
"date": "2026-04-06T22:57:46+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-06T22:57:54+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T13:42:01+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Quay 3.12",
"product": {
"name": "Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3.12::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774886169"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Abddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885564"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3Abdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774886107"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885572"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3Ab812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1775236144"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885641"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3Aefa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885604"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256%3A3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1775257350"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Ab227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885546"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1775253092"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Ae797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad?arch=arm64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885564"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4?arch=arm64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885572"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b?arch=arm64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885641"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85?arch=arm64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885604"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Ab75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7?arch=arm64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885546"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f?arch=arm64\u0026repository_url=registry.redhat.io/quay\u0026tag=1775253092"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885564"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885572"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3Aba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885641"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885604"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885546"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Acd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1775253092"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885564"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885572"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885641"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885604"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885546"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Ac8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1775253092"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-4598",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-03-23T06:01:47.891452+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450210"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. A remote attacker could exploit this vulnerability by providing specially crafted zero or negative inputs to the bnModInverse function within the BigInteger.modInverse implementation. This could lead to an infinite loop, causing a permanent denial of service (DoS) by hanging the process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Denial of Service via infinite loop in bnModInverse function with crafted inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT: A denial of service flaw was found in jsrsasign. This vulnerability allows a remote attacker to cause a permanent denial of service by providing specially crafted zero or negative inputs to the bnModInverse function, leading to an infinite loop. This affects Red Hat Migration Toolkit for Virtualization and Red Hat Quay, which utilize the vulnerable jsrsasign component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4598"
},
{
"category": "external",
"summary": "RHBZ#2450210",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450210"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4598",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4598"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4598",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4598"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264",
"url": "https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323",
"url": "https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/648",
"url": "https://github.com/kjur/jsrsasign/pull/648"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938"
}
],
"release_date": "2026-03-23T05:00:11.571000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-06T22:57:46+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6720"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Denial of Service via infinite loop in bnModInverse function with crafted inputs"
},
{
"cve": "CVE-2026-4599",
"cwe": {
"id": "CWE-338",
"name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"
},
"discovery_date": "2026-03-23T06:01:34.008562+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450207"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit an incomplete comparison vulnerability in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. By manipulating incorrect comparison checks, an attacker can bias the Digital Signature Algorithm (DSA) nonces during signature generation. This allows the attacker to recover the private key, leading to a critical security compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4599"
},
{
"category": "external",
"summary": "RHBZ#2450207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4599",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4599"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4599",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4599"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20",
"url": "https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1",
"url": "https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/647",
"url": "https://github.com/kjur/jsrsasign/pull/647"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939"
}
],
"release_date": "2026-03-23T05:00:12.522000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-06T22:57:46+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6720"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces"
},
{
"cve": "CVE-2026-4600",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-23T06:01:39.334925+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450208"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit improper verification of cryptographic signatures by supplying malicious domain parameters during the Digital Signature Algorithm (DSA) validation process. This allows the attacker to forge DSA signatures or X.509 certificates, which would then be accepted as legitimate, potentially leading to unauthorized access or data manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT. The flaw in jsrsasign allows an attacker to forge Digital Signature Algorithm (DSA) signatures or X.509 certificates by providing malicious domain parameters during validation. This could lead to unauthorized access or data manipulation in affected Red Hat products such as Migration Toolkit for Virtualization and Red Hat Quay, where jsrsasign is utilized for cryptographic signature verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4600"
},
{
"category": "external",
"summary": "RHBZ#2450208",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450208"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4600"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4600",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4600"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7",
"url": "https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60",
"url": "https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/646",
"url": "https://github.com/kjur/jsrsasign/pull/646"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940"
}
],
"release_date": "2026-03-23T05:00:08.475000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-06T22:57:46+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6720"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters"
},
{
"cve": "CVE-2026-4601",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-03-23T06:01:44.014846+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450209"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process, specifically within the KJUR.crypto.DSA.signWithMessageHash function. By manipulating the signature generation to force specific values, the library emits an invalid signature without retrying. This vulnerability allows an attacker to recover the private key used for signing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT: A flaw in the jsrsasign library allows for private key recovery due to a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process. An attacker can manipulate signature generation within the KJUR.crypto.DSA.signWithMessageHash function to force specific values, enabling the recovery of the private key. This impacts Red Hat products utilizing jsrsasign, such as Migration Toolkit for Virtualization and Red Hat Quay.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4601"
},
{
"category": "external",
"summary": "RHBZ#2450209",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450209"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4601"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4601",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4601"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586",
"url": "https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb",
"url": "https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/645",
"url": "https://github.com/kjur/jsrsasign/pull/645"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941"
}
],
"release_date": "2026-03-23T05:00:13.312000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-06T22:57:46+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6720"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing"
},
{
"cve": "CVE-2026-4602",
"cwe": {
"id": "CWE-681",
"name": "Incorrect Conversion between Numeric Types"
},
"discovery_date": "2026-03-23T06:01:28.729668+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450206"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. A remote attacker can exploit an incorrect conversion between numeric types by providing a negative exponent to the `modPow` function. This vulnerability can force the computation of incorrect modular inverses, which ultimately allows an attacker to bypass signature verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an IMPORTANT flaw. The `jsrsasign` library, as used in Red Hat products such as Migration Toolkit for Virtualization and Red Hat Quay, is vulnerable to a signature verification bypass. A remote attacker could provide a specially crafted negative exponent to the `modPow` function, leading to incorrect modular inverse computations and allowing them to bypass signature verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4602"
},
{
"category": "external",
"summary": "RHBZ#2450206",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450206"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4602"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4602",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4602"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5",
"url": "https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195",
"url": "https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/650",
"url": "https://github.com/kjur/jsrsasign/pull/650"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175"
}
],
"release_date": "2026-03-23T05:00:10.567000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-06T22:57:46+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6720"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-06T22:57:46+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6720"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-28498",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-03-16T19:02:00.128339+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448182"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Authlib, a Python library used for building OAuth and OpenID Connect (OIDC) servers. This vulnerability allows a remote attacker to bypass critical integrity checks in OIDC ID Tokens. Specifically, the library\u0027s internal hash verification logic fails open when encountering an unsupported cryptographic algorithm, accepting a forged ID Token as valid. This can lead to an authentication bypass, granting unauthorized access to systems relying on Authlib for OIDC authentication.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This IMPORTANT vulnerability in Authlib allows attackers to bypass OIDC ID Token integrity verification. The at_hash and c_hash validation fails open for unknown algorithms, accepting forged tokens as valid. Exploitation requires no authentication or user interaction. Impact is high to confidentiality and integrity. Red Hat products using Authlib for OIDC validation are affected. Fixed in version 1.6.9.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-28498"
},
{
"category": "external",
"summary": "RHBZ#2448182",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448182"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-28498",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28498"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28498",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28498"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b",
"url": "https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/releases/tag/v1.6.9",
"url": "https://github.com/authlib/authlib/releases/tag/v1.6.9"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j",
"url": "https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j"
}
],
"release_date": "2026-03-16T18:03:28.821000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-06T22:57:46+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6720"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens"
},
{
"cve": "CVE-2026-29063",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-06T19:00:57.982727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445291"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this vulnerability requires that an attacker is able to provide arbitrary data to clients of this library in a way that calls the affected functions with data the attacker controls. In most deployments, the ability to provide data in this fashion requires that an attacker has some degree of privileges to access the affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "RHBZ#2445291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
}
],
"release_date": "2026-03-06T18:25:22.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-06T22:57:46+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6720"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution"
},
{
"cve": "CVE-2026-30922",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-03-18T04:02:45.401296+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448553"
}
],
"notes": [
{
"category": "description",
"text": "An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-30922"
},
{
"category": "external",
"summary": "RHBZ#2448553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-30922",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-30922"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922"
},
{
"category": "external",
"summary": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0",
"url": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0"
},
{
"category": "external",
"summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r"
}
],
"release_date": "2026-03-18T02:29:45.857000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-06T22:57:46+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6720"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion"
},
{
"cve": "CVE-2026-32597",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-12T22:01:29.967713+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447194"
}
],
"notes": [
{
"category": "description",
"text": "A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "RHBZ#2447194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f"
}
],
"release_date": "2026-03-12T21:41:50.427000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-06T22:57:46+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6720"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:158e91355000c4527f878d43b11bab30caaeb8d85f707e69d94483c4d44ddd85_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:61da0ae799c1ef6e61cf3b2ba19ce998c2696328e5369704ef3e1c5402451d3f_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:766cc9d5bc7715992dc9ab459cf2700b2bf9e1aae72305e9716a3ff8e7534647_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:efa57d5681d08f42eaf9b00c451de912941f35396c210b9ac7e93273813bb8d9_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bdd86a8031e8e85fa8b61aebeade592793142d7bb14c97f08e6c81ff3342fa41_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:31e6e23006705ce61baec5b5a24ce6fee11bb9a8de805971dc09826bbf0617a4_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:446da34d353f43a7fb7f9cf90709c949e2035c37b181d6c262f91f6986597562_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6fdf7d2f9b3d617ffc488ba07a2cdaa5c4f522a20f7330e3d1c621ac1136533c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:91722cffb04ee1755fe217726481480f156e90575948a48b31d7f06869d6de9e_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b812db7818088897fc45d616725a2479f38cdf9ba35b1edb99bd08ad9d7c6263_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:0519329d2166634e0be19592c5962e0ab5b90485fa9f8c3a1e41aa5117730449_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:62636a5a9ab8da9f3ac0c173ba9f99d11cbe178c07650cf53ced9679044c0d7b_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:9d22bc2b0604a95c19ff3146e84282d0e70526d0c7ffda670b90200f2d0c1079_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba593b315c1a1df41a417f0c5f0108ad4b962f60e2cb86f1ea6ae8f24a71e0a6_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:4f4e3cc554f1b2f62d0d7adb2a1d45b92c23d221c637e66a8d8c515f518fe49a_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e97447d1bf5b862a38a8b97a79654c1ebcc109ca497f27be6a459317fcad544_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7da8a84159e9f026db0ac3401bdf0bf815352491328cac2364d26f70b906c0cf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:bddbe10ba4d0acef1d62dd3ac706880ba09d67fbb86846acec027ea019861f51_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e797bfc0a32e362e6a381112851ba179bad0153f871c52fb01c55859f628aaad_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:3a39fbee6d07db7234471c19af99164778bcdd5fcb0102157cdf70e173962d2c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:11b959fe38c2f4330cdda0bfa5375345b7671831ba7e2cfd7996df2d9d663c85_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:5ad64bc5b95669eee0a622ab568d3cd34e47910a05dc4a83c440af8f54ccee3e_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b227e106a92cc5bed111dbeff78f351e54ec927eb472f2650a8f7637bcfbd6aa_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:b75428cf56c763ab4f005b0930a37eaf0998ef51e9a63b1b33ed2d69b33426d7_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:356815af5f87ce3a8e0ee8213bb9b5537b658f29338b51f63672c7e5d7a5a50b_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:82a11b494b47a72a72edbbb595998ad0a00ade358acdffc58fb07217bdf9c67f_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c8bdf44dcdd96608b3dbb3c07bacbaa06d17e6e5333881559425edc53051f100_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:cd330fe833ad4ffa7fa3f2837c876e5ad7ab36f7770d3353f60673e0100b7c0c_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)"
}
]
}
RHSA-2026:6926
Vulnerability from csaf_redhat - Published: 2026-04-07 21:36 - Updated: 2026-07-02 00:19Summary
Red Hat Security Advisory: Red Hat Quay 3.9.20
Severity
Important
Notes
Topic: Red Hat Quay 3.9.20 is now available with bug fixes.
Details: Quay 3.9.20
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jsrsasign. An attacker can exploit an incomplete comparison vulnerability in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. By manipulating incorrect comparison checks, an attacker can bias the Digital Signature Algorithm (DSA) nonces during signature generation. This allows the attacker to recover the private key, leading to a critical security compromise.
9.1 (Critical)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. An attacker can exploit improper verification of cryptographic signatures by supplying malicious domain parameters during the Digital Signature Algorithm (DSA) validation process. This allows the attacker to forge DSA signatures or X.509 certificates, which would then be accepted as legitimate, potentially leading to unauthorized access or data manipulation.
8.2 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. An attacker can exploit a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process, specifically within the KJUR.crypto.DSA.signWithMessageHash function. By manipulating the signature generation to force specific values, the library emits an invalid signature without retrying. This vulnerability allows an attacker to recover the private key used for signing.
8.7 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. A remote attacker can exploit an incorrect conversion between numeric types by providing a negative exponent to the `modPow` function. This vulnerability can force the computation of incorrect modular inverses, which ultimately allows an attacker to bypass signature verification.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
8.8 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le | — |
Threats
Impact
Important
A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application's failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le | — |
Workaround
|
Threats
Impact
Important
An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le | — |
Workaround
|
Threats
Impact
Important
A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le | — |
Workaround
|
Threats
Impact
Important
References
67 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.9.20 is now available with bug fixes.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.9.20",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:6926",
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29063",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29074",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-30922",
"url": "https://access.redhat.com/security/cve/CVE-2026-30922"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32597",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4599",
"url": "https://access.redhat.com/security/cve/CVE-2026-4599"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4600",
"url": "https://access.redhat.com/security/cve/CVE-2026-4600"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4601",
"url": "https://access.redhat.com/security/cve/CVE-2026-4601"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4602",
"url": "https://access.redhat.com/security/cve/CVE-2026-4602"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6926.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Quay 3.9.20",
"tracking": {
"current_release_date": "2026-07-02T00:19:43+00:00",
"generator": {
"date": "2026-07-02T00:19:43+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:6926",
"initial_release_date": "2026-04-07T21:36:48+00:00",
"revision_history": [
{
"date": "2026-04-07T21:36:48+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-07T21:36:55+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T00:19:43+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Quay 3.9",
"product": {
"name": "Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3.9::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774886457"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885670"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3Af2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774887042"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885680"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1775183053"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885717"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885682"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256%3A6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1775184102"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885725"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Aa18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1775169218"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Ac3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885670"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Abfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885680"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885717"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885682"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Af845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885725"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1775169218"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885670"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885680"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885717"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3Ace200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885682"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Aef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885725"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1775169218"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-4599",
"cwe": {
"id": "CWE-338",
"name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"
},
"discovery_date": "2026-03-23T06:01:34.008562+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450207"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit an incomplete comparison vulnerability in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. By manipulating incorrect comparison checks, an attacker can bias the Digital Signature Algorithm (DSA) nonces during signature generation. This allows the attacker to recover the private key, leading to a critical security compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4599"
},
{
"category": "external",
"summary": "RHBZ#2450207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4599",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4599"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4599",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4599"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20",
"url": "https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1",
"url": "https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/647",
"url": "https://github.com/kjur/jsrsasign/pull/647"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939"
}
],
"release_date": "2026-03-23T05:00:12.522000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces"
},
{
"cve": "CVE-2026-4600",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-23T06:01:39.334925+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450208"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit improper verification of cryptographic signatures by supplying malicious domain parameters during the Digital Signature Algorithm (DSA) validation process. This allows the attacker to forge DSA signatures or X.509 certificates, which would then be accepted as legitimate, potentially leading to unauthorized access or data manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT. The flaw in jsrsasign allows an attacker to forge Digital Signature Algorithm (DSA) signatures or X.509 certificates by providing malicious domain parameters during validation. This could lead to unauthorized access or data manipulation in affected Red Hat products such as Migration Toolkit for Virtualization and Red Hat Quay, where jsrsasign is utilized for cryptographic signature verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4600"
},
{
"category": "external",
"summary": "RHBZ#2450208",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450208"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4600"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4600",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4600"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7",
"url": "https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60",
"url": "https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/646",
"url": "https://github.com/kjur/jsrsasign/pull/646"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940"
}
],
"release_date": "2026-03-23T05:00:08.475000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters"
},
{
"cve": "CVE-2026-4601",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-03-23T06:01:44.014846+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450209"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process, specifically within the KJUR.crypto.DSA.signWithMessageHash function. By manipulating the signature generation to force specific values, the library emits an invalid signature without retrying. This vulnerability allows an attacker to recover the private key used for signing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT: A flaw in the jsrsasign library allows for private key recovery due to a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process. An attacker can manipulate signature generation within the KJUR.crypto.DSA.signWithMessageHash function to force specific values, enabling the recovery of the private key. This impacts Red Hat products utilizing jsrsasign, such as Migration Toolkit for Virtualization and Red Hat Quay.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4601"
},
{
"category": "external",
"summary": "RHBZ#2450209",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450209"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4601"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4601",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4601"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586",
"url": "https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb",
"url": "https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/645",
"url": "https://github.com/kjur/jsrsasign/pull/645"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941"
}
],
"release_date": "2026-03-23T05:00:13.312000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing"
},
{
"cve": "CVE-2026-4602",
"cwe": {
"id": "CWE-681",
"name": "Incorrect Conversion between Numeric Types"
},
"discovery_date": "2026-03-23T06:01:28.729668+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450206"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. A remote attacker can exploit an incorrect conversion between numeric types by providing a negative exponent to the `modPow` function. This vulnerability can force the computation of incorrect modular inverses, which ultimately allows an attacker to bypass signature verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an IMPORTANT flaw. The `jsrsasign` library, as used in Red Hat products such as Migration Toolkit for Virtualization and Red Hat Quay, is vulnerable to a signature verification bypass. A remote attacker could provide a specially crafted negative exponent to the `modPow` function, leading to incorrect modular inverse computations and allowing them to bypass signature verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4602"
},
{
"category": "external",
"summary": "RHBZ#2450206",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450206"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4602"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4602",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4602"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5",
"url": "https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195",
"url": "https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/650",
"url": "https://github.com/kjur/jsrsasign/pull/650"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175"
}
],
"release_date": "2026-03-23T05:00:10.567000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling"
},
{
"cve": "CVE-2026-29063",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-06T19:00:57.982727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445291"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this vulnerability requires that an attacker is able to provide arbitrary data to clients of this library in a way that calls the affected functions with data the attacker controls. In most deployments, the ability to provide data in this fashion requires that an attacker has some degree of privileges to access the affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "RHBZ#2445291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
}
],
"release_date": "2026-03-06T18:25:22.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution"
},
{
"cve": "CVE-2026-29074",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-03-06T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445132"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application\u0027s failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "svgo: SVGO: Denial of Service via XML entity expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "RHBZ#2445132",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445132"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673",
"url": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673"
}
],
"release_date": "2026-03-06T07:23:05.716000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "svgo: SVGO: Denial of Service via XML entity expansion"
},
{
"cve": "CVE-2026-30922",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-03-18T04:02:45.401296+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448553"
}
],
"notes": [
{
"category": "description",
"text": "An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-30922"
},
{
"category": "external",
"summary": "RHBZ#2448553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-30922",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-30922"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922"
},
{
"category": "external",
"summary": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0",
"url": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0"
},
{
"category": "external",
"summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r"
}
],
"release_date": "2026-03-18T02:29:45.857000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion"
},
{
"cve": "CVE-2026-32597",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-12T22:01:29.967713+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447194"
}
],
"notes": [
{
"category": "description",
"text": "A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "RHBZ#2447194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f"
}
],
"release_date": "2026-03-12T21:41:50.427000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)"
}
]
}
RHSA-2026:7329
Vulnerability from csaf_redhat - Published: 2026-04-09 15:14 - Updated: 2026-07-02 00:19Summary
Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage
Severity
Important
Notes
Topic: A Subscription Management tool for finding and reporting Red Hat product usage
Details: Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds,
identifies, and reports environment data, or facts, such as the number of physical and virtual
systems on a network, their operating systems, and relevant configuration data stored within
them. Discovery also identifies and reports more detailed facts for some versions of key
Red Hat packages and products that it finds in the network.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in nodejs-lodash. A command injection flaw is possible through template variables.
7.2 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64 | — |
Vendor Fix
fix
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64 | — | ||
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64 | — |
Threats
Impact
Moderate
A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.
4.0 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).
5.3 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the imaplib module in the Python standard library. The imaplib module does not reject control characters, such as newlines, in user-controlled input passed to IMAP commands. This issue allows an attacker to inject additional commands to be executed in the IMAP server.
7.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the poplib module in the Python standard library. The poplib module does not reject control characters, such as newlines, in user-controlled input passed to POP3 commands. This issue allows an attacker to inject additional commands to be executed in the POP3 server.
7.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the email module in the Python standard library. When serializing an email message, the BytesGenerator class fails to properly quote newline characters for email headers. This issue is exploitable when the LiteralHeader class is used as it does not respect email folding rules, allowing an attacker to inject email headers and potentially modify message recipients or the email body, and spoof sender information.
7.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.
7.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
8.8 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64 | — |
Vendor Fix
fix
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64 | — | ||
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64 | — |
Threats
Impact
Important
References
73 references
Acknowledgments
Elhanan Haenel
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A Subscription Management tool for finding and reporting Red Hat product usage",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds,\nidentifies, and reports environment data, or facts, such as the number of physical and virtual\nsystems on a network, their operating systems, and relevant configuration data stored within\nthem. Discovery also identifies and reports more detailed facts for some versions of key\nRed Hat packages and products that it finds in the network.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:7329",
"url": "https://access.redhat.com/errata/RHSA-2026:7329"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2021-23337",
"url": "https://access.redhat.com/security/cve/CVE-2021-23337"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14831",
"url": "https://access.redhat.com/security/cve/CVE-2025-14831"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-15366",
"url": "https://access.redhat.com/security/cve/CVE-2025-15366"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-15367",
"url": "https://access.redhat.com/security/cve/CVE-2025-15367"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-9820",
"url": "https://access.redhat.com/security/cve/CVE-2025-9820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1299",
"url": "https://access.redhat.com/security/cve/CVE-2026-1299"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29063",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4111",
"url": "https://access.redhat.com/security/cve/CVE-2026-4111"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4519",
"url": "https://access.redhat.com/security/cve/CVE-2026-4519"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/subscription_central/1-latest/#Discovery",
"url": "https://docs.redhat.com/en/documentation/subscription_central/1-latest/#Discovery"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7329.json"
}
],
"title": "Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage",
"tracking": {
"current_release_date": "2026-07-02T00:19:44+00:00",
"generator": {
"date": "2026-07-02T00:19:44+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:7329",
"initial_release_date": "2026-04-09T15:14:31+00:00",
"revision_history": [
{
"date": "2026-04-09T15:14:31+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-09T15:14:44+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T00:19:44+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Discovery 2",
"product": {
"name": "Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:discovery:2::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Discovery"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"product": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"product_id": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-server-rhel9@sha256%3Aa3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde?arch=amd64\u0026repository_url=registry.redhat.io/discovery\u0026tag=1775668717"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"product": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"product_id": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-ui-rhel9@sha256%3A062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb?arch=amd64\u0026repository_url=registry.redhat.io/discovery\u0026tag=1775675922"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"product": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"product_id": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-server-rhel9@sha256%3A040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d?arch=arm64\u0026repository_url=registry.redhat.io/discovery\u0026tag=1775668717"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64",
"product": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64",
"product_id": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-ui-rhel9@sha256%3A364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0?arch=arm64\u0026repository_url=registry.redhat.io/discovery\u0026tag=1775675922"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64 as a component of Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64"
},
"product_reference": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"relates_to_product_reference": "Red Hat Discovery 2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64 as a component of Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64"
},
"product_reference": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"relates_to_product_reference": "Red Hat Discovery 2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64 as a component of Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64"
},
"product_reference": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"relates_to_product_reference": "Red Hat Discovery 2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64 as a component of Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
},
"product_reference": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64",
"relates_to_product_reference": "Red Hat Discovery 2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-23337",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2021-02-15T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1928937"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in nodejs-lodash. A command injection flaw is possible through template variables.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-lodash: command injection via template",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In OpenShift ServiceMesh (OSSM) and Red Hat OpenShift Jaeger (RHOSJ) the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-lodash library to authenticated users only, therefore the impact is low.\n\nWhile Red Hat Virtualization\u0027s cockpit-ovirt has a dependency on lodash it doesn\u0027t use the vulnerable template function.\n\nWhile Red Hat Quay has a dependency on lodash via restangular it doesn\u0027t use the vulnerable template function.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-23337"
},
{
"category": "external",
"summary": "RHBZ#1928937",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1928937"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-23337",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-23337"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-23337",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23337"
},
{
"category": "external",
"summary": "https://snyk.io/vuln/SNYK-JS-LODASH-1040724",
"url": "https://snyk.io/vuln/SNYK-JS-LODASH-1040724"
}
],
"release_date": "2021-02-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-09T15:14:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7329"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nodejs-lodash: command injection via template"
},
{
"cve": "CVE-2025-9820",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2025-09-02T10:00:18.839000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2392528"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Low, since exploitation requires local access or a malicious PKCS#11 token. While the impact is limited to denial of service or potential code execution in constrained scenarios, the vulnerability stems from a lack of proper bounds checking during token label handling in GnuTLS. Users should treat this as a security concern in environments where untrusted tokens may be introduced.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-9820"
},
{
"category": "external",
"summary": "RHBZ#2392528",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392528"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-9820",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9820"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/gnutls/-/commit/1d56f96f6ab5034d677136b9d50b5a75dff0faf5",
"url": "https://gitlab.com/gnutls/gnutls/-/commit/1d56f96f6ab5034d677136b9d50b5a75dff0faf5"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/gnutls/-/issues/1732",
"url": "https://gitlab.com/gnutls/gnutls/-/issues/1732"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18"
}
],
"release_date": "2025-11-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-09T15:14:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7329"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Applying the upstream patch or vendor-supplied security update is the recommended resolution.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function"
},
{
"cve": "CVE-2025-14831",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2025-12-17T14:48:30.222000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat. GnuTLS is susceptible to a denial of service attack due to excessive CPU and memory consumption. This occurs when processing specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs) during certificate verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14831"
},
{
"category": "external",
"summary": "RHBZ#2423177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14831",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14831"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14831",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14831"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/gnutls/-/issues/1773",
"url": "https://gitlab.com/gnutls/gnutls/-/issues/1773"
}
],
"release_date": "2026-02-09T14:26:34.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-09T15:14:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7329"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification"
},
{
"cve": "CVE-2025-15366",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"discovery_date": "2026-01-20T22:01:33.257688+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431368"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the imaplib module in the Python standard library. The imaplib module does not reject control characters, such as newlines, in user-controlled input passed to IMAP commands. This issue allows an attacker to inject additional commands to be executed in the IMAP server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cpython: IMAP command injection in user-controlled commands",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to have the privileges required to send malicious input to an application that sends IMAP commands to a server. Additionally, this flaw can allow attackers to manipulate the state of the mailbox (e.g., delete emails, move folders, flag messages) and to potentially read metadata or specific email content, but it does not allow arbitrary code execution or OS command injection. Due to these reasons, this issue has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-15366"
},
{
"category": "external",
"summary": "RHBZ#2431368",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431368"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-15366",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15366"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15366",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15366"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/143921",
"url": "https://github.com/python/cpython/issues/143921"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/143922",
"url": "https://github.com/python/cpython/pull/143922"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"
}
],
"release_date": "2026-01-20T21:40:24.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-09T15:14:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7329"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that no data passed to the imaplib module contains newline or carriage return characters.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cpython: IMAP command injection in user-controlled commands"
},
{
"cve": "CVE-2025-15367",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"discovery_date": "2026-01-20T22:02:09.399038+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431373"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the poplib module in the Python standard library. The poplib module does not reject control characters, such as newlines, in user-controlled input passed to POP3 commands. This issue allows an attacker to inject additional commands to be executed in the POP3 server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cpython: POP3 command injection in user-controlled commands",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to have the privileges required to send malicious input to an application that sends POP3 commands to a server. Additionally, this flaw can allow attackers to manipulate the state of the mailbox (e.g., delete emails) and to potentially read metadata or specific email content, but it does not allow arbitrary code execution or OS command injection. Due to these reasons, this issue has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-15367"
},
{
"category": "external",
"summary": "RHBZ#2431373",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431373"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-15367",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15367"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15367",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15367"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/143923",
"url": "https://github.com/python/cpython/issues/143923"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/143924",
"url": "https://github.com/python/cpython/pull/143924"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"
}
],
"release_date": "2026-01-20T21:47:09.885000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-09T15:14:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7329"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that no data passed to the poplib module contains newline or carriage return characters.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cpython: POP3 command injection in user-controlled commands"
},
{
"cve": "CVE-2026-1299",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-01-23T17:02:57.343486+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2432437"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the email module in the Python standard library. When serializing an email message, the BytesGenerator class fails to properly quote newline characters for email headers. This issue is exploitable when the LiteralHeader class is used as it does not respect email folding rules, allowing an attacker to inject email headers and potentially modify message recipients or the email body, and spoof sender information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cpython: email header injection due to unquoted newlines",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue can only be exploitable by Python applications using the LiteralHeader class to write email headers, as it does not respect email folding rules. Additionally, this issue allows attackers to modify message recipients or the email body and spoof sender identity but it does not cause memory corruption or arbitrary code execution. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1299"
},
{
"category": "external",
"summary": "RHBZ#2432437",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432437"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1299"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1299",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1299"
},
{
"category": "external",
"summary": "https://cve.org/CVERecord?id=CVE-2024-6923",
"url": "https://cve.org/CVERecord?id=CVE-2024-6923"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413",
"url": "https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/144125",
"url": "https://github.com/python/cpython/issues/144125"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/144126",
"url": "https://github.com/python/cpython/pull/144126"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/"
}
],
"release_date": "2026-01-23T16:27:13.346000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-09T15:14:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7329"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications accepting user-supplied data for email headers should sanitize the input by stripping or rejecting any strings containing carriage return or line feed characters, \u0027\\r\u0027 or \u0027\\n\u0027, respectively, preventing malicious sequences that could lead to header manipulation.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cpython: email header injection due to unquoted newlines"
},
{
"acknowledgments": [
{
"names": [
"Elhanan Haenel"
]
}
],
"cve": "CVE-2026-4111",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-03-11T11:18:51.609000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446453"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team would likely assess the severity of this vulnerability as High because it allows remote attackers to cause a persistent denial-of-service condition using a small crafted archive file. Successful exploitation requires no authentication, no special configuration, and no user interaction in environments that automatically process uploaded archives. By repeatedly submitting malicious archives, an attacker can exhaust CPU resources or worker threads in services such as file upload systems, CI/CD pipelines, mail scanners, and content indexing services that rely on libarchive for archive extraction.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4111"
},
{
"category": "external",
"summary": "RHBZ#2446453",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446453"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4111"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4111",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4111"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/pull/2877",
"url": "https://github.com/libarchive/libarchive/pull/2877"
}
],
"release_date": "2026-03-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-09T15:14:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7329"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive"
},
{
"cve": "CVE-2026-4519",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-03-20T16:02:13.494105+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449649"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: Python: Command-line option injection in webbrowser.open() via crafted URLs",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4519"
},
{
"category": "external",
"summary": "RHBZ#2449649",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4519",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4519"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/143930",
"url": "https://github.com/python/cpython/issues/143930"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/143931",
"url": "https://github.com/python/cpython/pull/143931"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/"
}
],
"release_date": "2026-03-20T15:08:32.576000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-09T15:14:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7329"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: Python: Command-line option injection in webbrowser.open() via crafted URLs"
},
{
"cve": "CVE-2026-29063",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-06T19:00:57.982727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445291"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this vulnerability requires that an attacker is able to provide arbitrary data to clients of this library in a way that calls the affected functions with data the attacker controls. In most deployments, the ability to provide data in this fashion requires that an attacker has some degree of privileges to access the affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "RHBZ#2445291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
}
],
"release_date": "2026-03-06T18:25:22.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-09T15:14:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7329"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:040dadd657afdb9f0914f896a4962fd3dbf40b70c8037e4d72b6801b766c9b7d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:a3c9eb11995a4e0b695a1fc54bb99a4e8a7fe69db01545f4f641cb69b6c80dde_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:062310de4b34e278f8c7e4634def673a77d1228d493541ef1264ba4cb83b68eb_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:364ac04db0b76b761a12fe6e58c2b165a518e1035015f74dd661af2fd64636e0_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution"
}
]
}
RHSA-2026:8218
Vulnerability from csaf_redhat - Published: 2026-04-15 01:45 - Updated: 2026-07-02 19:09Summary
Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.5 security update
Severity
Important
Notes
Topic: The multicluster engine for Kubernetes 2.8 General Availability release images,
which add new features and enhancements, bug fixes, and updated container images.
Details: The multicluster engine for Kubernetes v2.8 images
The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.
You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
104 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in database/sql. Concurrent queries can produce unexpected results when a query is cancelled during a Scan method call on returned Rows, creating a race condition. This vulnerability allows an attacker who can initiate and cancel queries to trigger this condition, possibly leading to inconsistent data being returned to the application.
7.0 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64 | — |
Vendor Fix
fix
|
Known not affected
104 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x | — |
Threats
Impact
Moderate
A flaw was found in the archive/tar package in the Go standard library. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A specially crafted tar archive with a pax header indicating a big number of sparse regions can cause a Go program to try to allocate a large amount of memory, causing an out-of-memory condition and resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
104 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
84 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang. A remote attacker could exploit this vulnerability by providing a specially crafted certificate during the error string construction process within the `HostnameError.Error()` function. This flaw, caused by unbounded string concatenation, leads to excessive resource consumption. Successful exploitation can result in a denial of service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64 | — |
Vendor Fix
fix
|
Known not affected
104 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x | — |
Threats
Impact
Important
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64 | — |
Vendor Fix
fix
|
Known not affected
104 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x | — |
Threats
Impact
Moderate
A cross site scripting flaw has been discovered in the npm react-router and @remix-run/router packages. React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect.
8.0 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
104 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x | — |
Workaround
|
Threats
Impact
Important
A denial of service flaw has been discovered in the Axios npm package. the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
104 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64 | — |
Workaround
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le | — |
Vendor Fix
fix
|
Known not affected
104 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64 | — | ||
| Unresolved product id: multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x | — |
Threats
Impact
Important
References
77 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "The multicluster engine for Kubernetes 2.8 General Availability release images,\nwhich add new features and enhancements, bug fixes, and updated container images.",
"title": "Topic"
},
{
"category": "general",
"text": "The multicluster engine for Kubernetes v2.8 images\n\nThe multicluster engine for Kubernetes provides the foundational components\nthat are necessary for the centralized management of multiple\nKubernetes-based clusters across data centers, public clouds, and private\nclouds.\n\nYou can use the engine to create new Red Hat OpenShift Container Platform\nclusters or to bring existing Kubernetes-based clusters under management by\nimporting them. After the clusters are managed, you can use the APIs that\nare provided by the engine to distribute configuration based on placement\npolicy.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8218",
"url": "https://access.redhat.com/errata/RHSA-2026:8218"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-13465",
"url": "https://access.redhat.com/security/cve/CVE-2025-13465"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-47907",
"url": "https://access.redhat.com/security/cve/CVE-2025-47907"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-58183",
"url": "https://access.redhat.com/security/cve/CVE-2025-58183"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-61726",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-61729",
"url": "https://access.redhat.com/security/cve/CVE-2025-61729"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-68121",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-22029",
"url": "https://access.redhat.com/security/cve/CVE-2026-22029"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25639",
"url": "https://access.redhat.com/security/cve/CVE-2026-25639"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29063",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8218.json"
}
],
"title": "Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.5 security update",
"tracking": {
"current_release_date": "2026-07-02T19:09:36+00:00",
"generator": {
"date": "2026-07-02T19:09:36+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:8218",
"initial_release_date": "2026-04-15T01:45:31+00:00",
"revision_history": [
{
"date": "2026-04-15T01:45:31+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-15T01:45:39+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T19:09:36+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "multicluster engine for Kubernetes 2.8",
"product": {
"name": "multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:multicluster_engine:2.8::el9"
}
}
}
],
"category": "product_family",
"name": "multicluster engine for Kubernetes"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"product_id": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"product_identification_helper": {
"purl": "pkg:oci/addon-manager-rhel9@sha256%3A8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638648"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"product_id": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"product_identification_helper": {
"purl": "pkg:oci/must-gather-rhel9@sha256%3Ab9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774990481"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"product_id": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/backplane-rhel9-operator@sha256%3Abaedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775518980"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"product_id": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-api-provider-agent-rhel9@sha256%3Ac18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775346065"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"product_id": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-api-provider-kubevirt-rhel9@sha256%3A384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913637"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"product_id": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-curator-controller-rhel9@sha256%3A5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913604"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"product_id": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-image-set-controller-rhel9@sha256%3A1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913615"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"product_id": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-proxy-addon-rhel9@sha256%3A61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913693"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"product_id": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-proxy-rhel9@sha256%3Ab0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775441905"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"product_id": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clusterclaims-controller-rhel9@sha256%3A1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774918593"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"product_id": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clusterlifecycle-state-metrics-rhel9@sha256%3Ae9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774925022"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"product_id": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"product_identification_helper": {
"purl": "pkg:oci/console-mce-rhel9@sha256%3A896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775116156"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"product_id": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-rhel9@sha256%3A850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913711"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"product_id": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/hive-rhel9@sha256%3Ad2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775259683"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"product_id": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"product_identification_helper": {
"purl": "pkg:oci/hypershift-addon-rhel9-operator@sha256%3Ad2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913832"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"product_id": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"product_identification_helper": {
"purl": "pkg:oci/hypershift-cli-rhel9@sha256%3Ac3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913767"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"product_id": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"product_identification_helper": {
"purl": "pkg:oci/hypershift-rhel9-operator@sha256%3A9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913854"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"product_id": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/image-based-install-rhel9@sha256%3A8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774986989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"product_id": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kube-rbac-proxy-mce-rhel9@sha256%3Abb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913844"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"product_id": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/managed-serviceaccount-rhel9@sha256%3A9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775441911"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"product_id": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"product_identification_helper": {
"purl": "pkg:oci/managedcluster-import-controller-rhel9@sha256%3A3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775198475"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"product_id": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicloud-manager-rhel9@sha256%3A31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775441898"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"product_id": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"product_identification_helper": {
"purl": "pkg:oci/placement-rhel9@sha256%3A32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638675"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"product_id": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/provider-credential-controller-rhel9@sha256%3Afd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775231857"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"product_id": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"product_identification_helper": {
"purl": "pkg:oci/registration-rhel9@sha256%3A548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638726"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"product_id": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"product_identification_helper": {
"purl": "pkg:oci/registration-operator-rhel9@sha256%3A2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638748"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"product": {
"name": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"product_id": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/work-rhel9@sha256%3A08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638726"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"product_id": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/addon-manager-rhel9@sha256%3Ab0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638648"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"product_id": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"product_identification_helper": {
"purl": "pkg:oci/must-gather-rhel9@sha256%3A45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774990481"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"product_id": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"product_identification_helper": {
"purl": "pkg:oci/backplane-rhel9-operator@sha256%3A6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775518980"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"product_id": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-api-provider-agent-rhel9@sha256%3Aa368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775346065"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"product_id": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-api-provider-kubevirt-rhel9@sha256%3A98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913637"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"product_id": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-curator-controller-rhel9@sha256%3A89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913604"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"product_id": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-image-set-controller-rhel9@sha256%3Aad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913615"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"product_id": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-proxy-addon-rhel9@sha256%3A3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913693"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"product_id": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-proxy-rhel9@sha256%3Aac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775441905"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"product_id": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"product_identification_helper": {
"purl": "pkg:oci/clusterclaims-controller-rhel9@sha256%3Ab496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774918593"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"product_id": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"product_identification_helper": {
"purl": "pkg:oci/clusterlifecycle-state-metrics-rhel9@sha256%3A36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774925022"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"product_id": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"product_identification_helper": {
"purl": "pkg:oci/console-mce-rhel9@sha256%3A7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775116156"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"product_id": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-rhel9@sha256%3Ad7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913711"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"product_id": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"product_identification_helper": {
"purl": "pkg:oci/hive-rhel9@sha256%3Ac02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775259683"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"product_id": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"product_identification_helper": {
"purl": "pkg:oci/hypershift-addon-rhel9-operator@sha256%3Afff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913832"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"product_id": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"product_identification_helper": {
"purl": "pkg:oci/hypershift-cli-rhel9@sha256%3A4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913767"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"product_id": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"product_identification_helper": {
"purl": "pkg:oci/hypershift-rhel9-operator@sha256%3A1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913854"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"product_id": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"product_identification_helper": {
"purl": "pkg:oci/image-based-install-rhel9@sha256%3Ae227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774986989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"product_id": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kube-rbac-proxy-mce-rhel9@sha256%3A62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913844"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"product_id": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"product_identification_helper": {
"purl": "pkg:oci/managed-serviceaccount-rhel9@sha256%3Af1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775441911"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"product_id": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"product_identification_helper": {
"purl": "pkg:oci/managedcluster-import-controller-rhel9@sha256%3A11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775198475"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"product_id": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicloud-manager-rhel9@sha256%3A5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775441898"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"product_id": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"product_identification_helper": {
"purl": "pkg:oci/placement-rhel9@sha256%3Ac0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638675"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"product_id": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/provider-credential-controller-rhel9@sha256%3A24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775231857"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"product_id": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/registration-rhel9@sha256%3A126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638726"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"product_id": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"product_identification_helper": {
"purl": "pkg:oci/registration-operator-rhel9@sha256%3Ab98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638748"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"product": {
"name": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"product_id": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"product_identification_helper": {
"purl": "pkg:oci/work-rhel9@sha256%3A4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638726"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/addon-manager-rhel9@sha256%3Af6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638648"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/must-gather-rhel9@sha256%3A9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774990481"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/backplane-rhel9-operator@sha256%3A5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775518980"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/cluster-api-provider-agent-rhel9@sha256%3A797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775346065"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/cluster-api-provider-kubevirt-rhel9@sha256%3A6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913637"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/cluster-curator-controller-rhel9@sha256%3A928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913604"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/cluster-image-set-controller-rhel9@sha256%3A6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913615"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/cluster-proxy-addon-rhel9@sha256%3Ad69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913693"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/cluster-proxy-rhel9@sha256%3Ad47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775441905"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clusterclaims-controller-rhel9@sha256%3A4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774918593"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clusterlifecycle-state-metrics-rhel9@sha256%3Aa8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774925022"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/console-mce-rhel9@sha256%3Aa520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775116156"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/discovery-rhel9@sha256%3Ac9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913711"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/hive-rhel9@sha256%3Ac95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775259683"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/hypershift-addon-rhel9-operator@sha256%3Afb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913832"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/hypershift-cli-rhel9@sha256%3A913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913767"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/hypershift-rhel9-operator@sha256%3Ab078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913854"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/image-based-install-rhel9@sha256%3A9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774986989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kube-rbac-proxy-mce-rhel9@sha256%3Ad81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913844"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/managed-serviceaccount-rhel9@sha256%3A758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775441911"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/managedcluster-import-controller-rhel9@sha256%3A7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775198475"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicloud-manager-rhel9@sha256%3A5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775441898"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/placement-rhel9@sha256%3A05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638675"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/provider-credential-controller-rhel9@sha256%3A4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775231857"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/registration-rhel9@sha256%3A772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638726"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/registration-operator-rhel9@sha256%3Aeeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638748"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"product_id": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/work-rhel9@sha256%3A174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638726"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"product_id": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"product_identification_helper": {
"purl": "pkg:oci/addon-manager-rhel9@sha256%3Ae7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638648"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"product_id": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"product_identification_helper": {
"purl": "pkg:oci/must-gather-rhel9@sha256%3A97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774990481"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"product_id": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/backplane-rhel9-operator@sha256%3A553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775518980"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"product_id": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/cluster-api-provider-agent-rhel9@sha256%3Ad4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775346065"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"product_id": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/cluster-api-provider-kubevirt-rhel9@sha256%3Ae26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913637"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"product_id": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/cluster-curator-controller-rhel9@sha256%3Aad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913604"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"product_id": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"product_identification_helper": {
"purl": "pkg:oci/cluster-image-set-controller-rhel9@sha256%3Af4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913615"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"product_id": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/cluster-proxy-addon-rhel9@sha256%3A74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913693"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"product_id": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"product_identification_helper": {
"purl": "pkg:oci/cluster-proxy-rhel9@sha256%3A79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775441905"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"product_id": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clusterclaims-controller-rhel9@sha256%3Addda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774918593"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"product_id": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clusterlifecycle-state-metrics-rhel9@sha256%3A575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774925022"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"product_id": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/console-mce-rhel9@sha256%3A4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775116156"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"product_id": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"product_identification_helper": {
"purl": "pkg:oci/discovery-rhel9@sha256%3A4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913711"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"product_id": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"product_identification_helper": {
"purl": "pkg:oci/hive-rhel9@sha256%3A6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775259683"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"product_id": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"product_identification_helper": {
"purl": "pkg:oci/hypershift-addon-rhel9-operator@sha256%3A55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913832"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"product_id": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/hypershift-cli-rhel9@sha256%3Ad57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913767"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"product_id": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/hypershift-rhel9-operator@sha256%3A17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913854"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"product_id": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"product_identification_helper": {
"purl": "pkg:oci/image-based-install-rhel9@sha256%3A9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774986989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"product_id": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kube-rbac-proxy-mce-rhel9@sha256%3Adad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1774913844"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"product_id": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/managed-serviceaccount-rhel9@sha256%3A4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775441911"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"product_id": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"product_identification_helper": {
"purl": "pkg:oci/managedcluster-import-controller-rhel9@sha256%3A132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775198475"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"product_id": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicloud-manager-rhel9@sha256%3A1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775441898"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"product_id": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"product_identification_helper": {
"purl": "pkg:oci/placement-rhel9@sha256%3A18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638675"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"product_id": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"product_identification_helper": {
"purl": "pkg:oci/provider-credential-controller-rhel9@sha256%3A659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775231857"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"product_id": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/registration-rhel9@sha256%3Ad6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638726"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"product_id": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/registration-operator-rhel9@sha256%3Ae7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638748"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x",
"product": {
"name": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x",
"product_id": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x",
"product_identification_helper": {
"purl": "pkg:oci/work-rhel9@sha256%3Ade69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1775638726"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64"
},
"product_reference": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64 as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64"
},
"product_reference": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x as a component of multicluster engine for Kubernetes 2.8",
"product_id": "multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
},
"product_reference": "registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x",
"relates_to_product_reference": "multicluster engine for Kubernetes 2.8"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-13465",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"discovery_date": "2026-01-21T20:01:28.774829+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431740"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: prototype pollution in _.unset and _.omit functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is only exploitable by applications using the _.unset and _.omit functions on an object and allowing user input to determine the path of the property to be removed. This issue only allows the deletion of properties but does not allow overwriting their behavior, limiting the impact to a denial of service. Due to this reason, this vulnerability has been rated with an important severity.\n\nIn Grafana, JavaScript code runs only in the browser, while the server side is all Golang. Therefore, the worst-case scenario is a loss of functionality in the client application inside the browser. To reflect this, the CVSS availability metric and the severity of the Grafana and the Grafana-PCP component have been updated to low and moderate, respectively.\n\nThe lodash dependency is bundled and used by the pcs-web-ui component of the PCS package. In Red Hat Enterprise Linux 8.10, the pcs-web-ui component is no longer included in the PCS package. As a result, RHEL 8.10 does not ship the vulnerable lodash component within PCS and is therefore not-affected by this CVE.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le"
],
"known_not_affected": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13465"
},
{
"category": "external",
"summary": "RHBZ#2431740",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431740"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13465"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg",
"url": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg"
}
],
"release_date": "2026-01-21T19:05:28.846000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-15T01:45:31+00:00",
"details": "For multicluster engine for Kubernetes, see the following documentation for\ndetails on how to install the images:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8218"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example.",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: prototype pollution in _.unset and _.omit functions"
},
{
"cve": "CVE-2025-47907",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"discovery_date": "2025-08-07T16:01:06.247481+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2387083"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in database/sql. Concurrent queries can produce unexpected results when a query is cancelled during a Scan method call on returned Rows, creating a race condition. This vulnerability allows an attacker who can initiate and cancel queries to trigger this condition, possibly leading to inconsistent data being returned to the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "database/sql: Postgres Scan Race Condition",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability marked as Moderate severity issues rather than Important. The os/exec LookPath flaw requires a misconfigured PATH to be exploitable, and the database/sql race condition primarily impacts applications that cancel queries while running multiple queries concurrently. Both can cause unexpected behavior, but the exploitation scope is limited and unlikely to result in direct compromise in most typical deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64"
],
"known_not_affected": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-47907"
},
{
"category": "external",
"summary": "RHBZ#2387083",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2387083"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-47907",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47907"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-47907",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47907"
},
{
"category": "external",
"summary": "https://go.dev/cl/693735",
"url": "https://go.dev/cl/693735"
},
{
"category": "external",
"summary": "https://go.dev/issue/74831",
"url": "https://go.dev/issue/74831"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/x5MKroML2yM",
"url": "https://groups.google.com/g/golang-announce/c/x5MKroML2yM"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2025-3849",
"url": "https://pkg.go.dev/vuln/GO-2025-3849"
}
],
"release_date": "2025-08-07T15:25:30.704000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-15T01:45:31+00:00",
"details": "For multicluster engine for Kubernetes, see the following documentation for\ndetails on how to install the images:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8218"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "database/sql: Postgres Scan Race Condition"
},
{
"cve": "CVE-2025-58183",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2025-10-29T23:01:50.573951+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2407258"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the archive/tar package in the Go standard library. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A specially crafted tar archive with a pax header indicating a big number of sparse regions can cause a Go program to try to allocate a large amount of memory, causing an out-of-memory condition and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: archive/tar: Unbounded allocation when parsing GNU sparse map",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to be able to process a specially crafted GNU tar pax 1.0 archive with the application using the archive/tar package. Additionally, this issue can cause the Go application to allocate a large amount of memory, eventually leading to an out-of-memory condition and resulting in a denial of service with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64"
],
"known_not_affected": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-58183"
},
{
"category": "external",
"summary": "RHBZ#2407258",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2407258"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-58183",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58183"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-58183",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58183"
},
{
"category": "external",
"summary": "https://go.dev/cl/709861",
"url": "https://go.dev/cl/709861"
},
{
"category": "external",
"summary": "https://go.dev/issue/75677",
"url": "https://go.dev/issue/75677"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI",
"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2025-4014",
"url": "https://pkg.go.dev/vuln/GO-2025-4014"
}
],
"release_date": "2025-10-29T22:10:14.376000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-15T01:45:31+00:00",
"details": "For multicluster engine for Kubernetes, see the following documentation for\ndetails on how to install the images:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8218"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: archive/tar: Unbounded allocation when parsing GNU sparse map"
},
{
"cve": "CVE-2025-61726",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:42.791305+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64"
],
"known_not_affected": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "RHBZ#2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://go.dev/cl/736712",
"url": "https://go.dev/cl/736712"
},
{
"category": "external",
"summary": "https://go.dev/issue/77101",
"url": "https://go.dev/issue/77101"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4341",
"url": "https://pkg.go.dev/vuln/GO-2026-4341"
}
],
"release_date": "2026-01-28T19:30:31.215000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-15T01:45:31+00:00",
"details": "For multicluster engine for Kubernetes, see the following documentation for\ndetails on how to install the images:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8218"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
},
{
"cve": "CVE-2025-61729",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2025-12-02T20:01:45.330964+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418462"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang. A remote attacker could exploit this vulnerability by providing a specially crafted certificate during the error string construction process within the `HostnameError.Error()` function. This flaw, caused by unbounded string concatenation, leads to excessive resource consumption. Successful exploitation can result in a denial of service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64"
],
"known_not_affected": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61729"
},
{
"category": "external",
"summary": "RHBZ#2418462",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418462"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61729",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61729"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729"
},
{
"category": "external",
"summary": "https://go.dev/cl/725920",
"url": "https://go.dev/cl/725920"
},
{
"category": "external",
"summary": "https://go.dev/issue/76445",
"url": "https://go.dev/issue/76445"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4",
"url": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2025-4155",
"url": "https://pkg.go.dev/vuln/GO-2025-4155"
}
],
"release_date": "2025-12-02T18:54:10.166000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-15T01:45:31+00:00",
"details": "For multicluster engine for Kubernetes, see the following documentation for\ndetails on how to install the images:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8218"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
},
{
"cve": "CVE-2025-68121",
"discovery_date": "2026-02-05T18:01:30.086058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437111"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64"
],
"known_not_affected": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "RHBZ#2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://go.dev/cl/737700",
"url": "https://go.dev/cl/737700"
},
{
"category": "external",
"summary": "https://go.dev/issue/77217",
"url": "https://go.dev/issue/77217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
"url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4337",
"url": "https://pkg.go.dev/vuln/GO-2026-4337"
}
],
"release_date": "2026-02-05T17:48:44.141000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-15T01:45:31+00:00",
"details": "For multicluster engine for Kubernetes, see the following documentation for\ndetails on how to install the images:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8218"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
},
{
"cve": "CVE-2026-22029",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-01-10T04:01:03.694749+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2428412"
}
],
"notes": [
{
"category": "description",
"text": "A cross site scripting flaw has been discovered in the npm react-router and @remix-run/router packages. React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "@remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le"
],
"known_not_affected": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-22029"
},
{
"category": "external",
"summary": "RHBZ#2428412",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428412"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-22029",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22029"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22029",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22029"
},
{
"category": "external",
"summary": "https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx",
"url": "https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx"
}
],
"release_date": "2026-01-10T02:42:32.736000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-15T01:45:31+00:00",
"details": "For multicluster engine for Kubernetes, see the following documentation for\ndetails on how to install the images:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8218"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "@remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects"
},
{
"cve": "CVE-2026-25639",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-02-09T21:00:49.280114+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2438237"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw has been discovered in the Axios npm package. the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le"
],
"known_not_affected": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25639"
},
{
"category": "external",
"summary": "RHBZ#2438237",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438237"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25639",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25639"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25639",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25639"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57",
"url": "https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.13.5",
"url": "https://github.com/axios/axios/releases/tag/v1.13.5"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433",
"url": "https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433"
}
],
"release_date": "2026-02-09T20:11:22.374000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-15T01:45:31+00:00",
"details": "For multicluster engine for Kubernetes, see the following documentation for\ndetails on how to install the images:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8218"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig"
},
{
"cve": "CVE-2026-29063",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-06T19:00:57.982727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445291"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this vulnerability requires that an attacker is able to provide arbitrary data to clients of this library in a way that calls the affected functions with data the attacker controls. In most deployments, the ability to provide data in this fashion requires that an attacker has some degree of privileges to access the affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le"
],
"known_not_affected": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "RHBZ#2445291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
}
],
"release_date": "2026-03-06T18:25:22.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-15T01:45:31+00:00",
"details": "For multicluster engine for Kubernetes, see the following documentation for\ndetails on how to install the images:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro",
"product_ids": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8218"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:ac44ed8760e5bf9d701b3cf4296805d1df6f6b9cb57b3e0a7557239de1a542b7_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:b0c796e0d0eea701ebcb55c646042a020d71e18595e260644884596b04dd1def_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:d47167421192458b70433c97afbee742ede2a650c7af0ce54b126fa251cc1ea7_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:1ab0fe650316e0640421fbc361eae235c4a0175c7467acd5e8ad414a8fd1fc75_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:4355c558ed342b1e96f4b23c53b229d22ef4ee48378980eb7359d7864e15fe6d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:b496e4274643266a37d7ba7134f71e3aa262df65e4c04b9148ee9d7a67da669a_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:ddda8b74fb8cbde98a90fc89c62608dce08a022c0e63ae90a1a0b52123da1c2c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:36b56d6b9609512532fdae217b892ebc40ce774161e6f90176b052cf7ee686a3_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:575cb613c7cc81507a3e6235e30b0ffbb34f145e2bb6b97632d68ed5e73fd090_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:a8d65fb8b81be9613bc732f696ef245aad46a23335de455d258598dd86c19f8d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:e9d6ed28fbbe6a3aeb2050c6e8fc3f8a5b6cc7546ee996006e92031294f83d2f_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4943997b1fed0e8fada897f8296fafd2ec82c69d51f0779b0f1591c9ce2dcc2a_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:7f98a0535715ba9925f93f16c41fc2cfdc16ee8fb32654336f7c5a09b0e7d9dd_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:896deef9b7467a814e9e79a4366da9daf969b2c260ec30a517dfa30887e10205_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a520297678ce3bd9a01a1e64b41833535d30ba469e55f26c462af1303c0f959d_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:4100f29f8a8ba48956cc570cc2a65bc38b9fffa9b946fc3c6253bd0a54f25065_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:850c60717c0c3a8cdc7bb742721e73dbcd8928443fb6776003e3ca71fdd17982_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:c9e8a0a70d60dd717a2f9c8018f1ce963ce25079476a64e8743e826e616ffb00_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:d7dd81c6f47faf4e07602dfed2229b27d8064d8180009b4bc62189030575d421_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:6a25acbc7851fdb9ab19d6f3286e50db85f07064f59a604aedaff48800b06572_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c02087ae03cff78d4a3fba8887ef55d33cd00a8f2f74806368bf683fa73c0e46_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:c95f5edf4111dc9077d07c0c81df6fc238c6d048d22793f83f7be08bc673b9d3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hive-rhel9@sha256:d2cc92420cffc159ce7f27104ba9e49745198e9e3314683209624e4a1a3f041a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:55928ce9d57439303297ac900fc0b4f95de64ee691a332a21995cf09342c1aff_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:d2949213c7c3f93b0b59082ecdc69f4e05b8038a43afc216926ec43714a73346_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fb49af7cc738943c59aef8a8b860b00f5e854cc95d58a88461c30ebea0f329c3_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:fff7cebbf5360ae8830e3650f72b5c269be15b9892848f0a3408ed47abb5a5ad_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:4d8f346ef3bffeed12b3c64e5ebed22f8d79397e915c0bfbbc5bf03ee809c0a0_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:913120c0fc826c2f8ed1f2cba5e71c91e2c440e50be043ab912d688b230aa0fb_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:c3633df794c0803b27d8607d1391eb66af8c104712584ba326d04e4cae8627d6_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:d57138c750131113f09ce1259f5702a0d4b984fb29d5d7994c5dc4ad6aaaf39b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:1766984333b3b3d1d1614bafef596fb94351b3358e04e32d46e20752b60a0d9e_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:17c676d8e456102d877a7feee97c7164ee9f71e21763c5561bed8ac24e5dc2d0_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:9e94ed8885a79d3c7ca3a41ffba43455b410435ea0090fb5c6598eefc5156b22_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:b078e01e6a3d6a04c2e364d42aa4a5be37bb2aa279ae484c524ae58293aacc3a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:8edafac72bd8526384c33b749595be0986d86957b79ac7ac7ae37b435f27351e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9532ce55aa8e3553bd102a891ca6e2b6cf93f23da41c71ba184e769dd1328410_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:9d146a6192bc9251ceb9443e32c708cfbb7cd542f6d9621c1dbbbdff50ede9ae_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:e227cdab2e061d70761d510b0d9c99b4dcf735d0257809c6757155ef18bb341f_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:62fd673d06de31af8b7946b6eb657c69e064dc1e8639197e689375be3a331c90_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:bb9014907e1d57647589efe637bf133e631d03ac94e1c30181eccf6ea8bddc6b_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:d81f2ab37bd8c6e5aaccd0ed2b94fbc2bf88934f3ffda8fde7add64b9f051966_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:dad80c9983167fb8fd98912c890b3a1dbcac2cbadf417c7771a3fda2f23f832c_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4be015b2648cd7f4edb2aa29521f283959db8336ce4df5497ad8465a031bd3c4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:758c0f95e9895b61a86e3ff4f4c2570f278c7af13ad3a5876d785829b746bf42_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:9082cef0cbf513a3c33309be5e83774cf92ddae6045c571f43718583da451d8d_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:f1f8475bacfa68df75fa015dfd7fb73565ed2b0b73fe8eeec26c2831862d7175_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:11e40e57f6d48e0eba7e4ed12f4ef55b84ec9f93d2534712318d259dc4fcf4a5_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:132e7098ba9e2ac1e02e04e828359073ecc322a5e9e804badb1e0e5934ff32fe_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:3cdd76fda529eb46161cac023a40b1420d85cfe6ac9100986796e4f49ea5e7c2_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:7805f6d13f8a8a1309c2821622706e0e81c6b0a99f18ca761f031937d67fd484_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:1b8f3645dca1f463be8be4f3bbde53cfb0a28412ddc7f20eed9e39b4f7f02979_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:31b3f532cfa55e76563251f01008c9998b71ba33a4dd75c3307db32173d6ff39_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5a063e1f8a5d0ff90f7c948f332fff502fc00be8ede14bd0ef4b38ab09717c72_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:5cde57462724bc2ebd303b29d6127d2fdffcd4c4b93ea443eb6ac55290031960_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:45ef14cb6ce30aaf3780fbb5656dae822825b892e165469c0c732e613f452c94_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9460807bdb775b166264de2b0a5eb348b144cb9a7a0b1d42190a3ce54bea8d63_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:97bb4216555694418e609366ecb47bd1c8336c1e97e76039df4949c5be4fb997_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:b9bc631124b8d4f95faf4de518915fc8bd519edf11055b703ee223c0c4813b52_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:05689e767759be2e46620c752e079847fad0941193456dad22ed33111e69f44c_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:18b0f392942a743b23dc4db9ccccaf467053e70bdad97f1714d0d413f66eaf71_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:32e1fac10eb855484152f41d6a2e4b3fa6fb9c63afd10c5d546db29916f40816_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/placement-rhel9@sha256:c0aeadd784317f5d0a5415bb2002ab6116f2c947c00fc8df9e2a91e907e108bf_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:24c9f0cb19b5e95ee037583eff0c5e683c98d65868f57221e36db1fe1aaad96b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:4def0b462d24131336a8f641edf6206d9eac005b61d1abd3739b549e74794ee9_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:659a041590140f69a2a0952769a53240e12d770cb7440fc0ac1af4198470e684_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:fd72d5e49c2d10e1ccb16547ee8563ad5c1c4a09960f6c3563b8f394e031c50e_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:2ff4c94a03c71dc68b519db391d0b7f9787e7709df2e5d16aa837fcf522418de_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:b98f70827db37e91dc99336043552d1375cd94a7bbab3c0abcfa7f7d33b3d3d6_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:e7adcd557f69ccf4893c0f40b5ccb19264a401ea98436b5072d1b7593d120bc4_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:eeaf14966d50a750a665ef6304f3ca82b50c0cfe147acf796714ddd0642d51f2_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:126b982ac1e4ca447773a3c9099691f0ad5dca0d7a4101877724421d613c459b_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:548fe802bc62d3ff20ee0b13dcd9792eb304f11d5d496562ad1c2d80b5796c67_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:772e9e4da783b4d33ff1846a6b8fc9ab7acefe76dd21eb3030c83f6352050894_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/registration-rhel9@sha256:d6622aa3381f9ac73e6f3c9764ffe357a434d021c62d20d5a95ebb586b66d87b_s390x",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:08ffacc73e8bdd40fbd4e913971eb1621a09329c85ec123e1781c08515cf3b5a_amd64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:174f055bd042d6ec4e056ef9f6bb430f0b7e68211ee56155aee1d02f6b26a53a_ppc64le",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:4248348b507e9a78095ffa9d7a2ef4ff87880f65fdfc8ae71e67018655705c53_arm64",
"multicluster engine for Kubernetes 2.8:registry.redhat.io/multicluster-engine/work-rhel9@sha256:de69889c3af110ae6613401431a384781ece6f82bbe2933b81dedef602be9005_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution"
}
]
}
RHSA-2026:8483
Vulnerability from csaf_redhat - Published: 2026-04-16 13:44 - Updated: 2026-07-02 19:19Summary
Red Hat Security Advisory: Kiali 1.73.29 for Red Hat OpenShift Service Mesh 2.6
Severity
Critical
Notes
Topic: Kiali 1.73.29 for Red Hat OpenShift Service Mesh 2.6 is now available.
An update is now available for Red Hat OpenShift Service Mesh 2.6. This advisory contains the RPM packages for the Kiali component.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Kiali 1.73.29, for Red Hat OpenShift Service Mesh 2.6, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.
Security Fix(es):
* CVE-2025-61726 Memory exhaustion in query parameter parsing in net/url (OSSM-12470)
* CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13225, OSSM-13226)
* CVE-2025-68121 Unexpected session resumption in crypto/tls (OSSM-12553)
* CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-12952)
* CVE-2026-27606 Rollup: Remote Code Execution via Path Traversal Vulnerability (OSSM-12689)
* CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-12891)
* CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (OSSM-12970, OSSM-12971)
* CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-12996)
* CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13112, OSSM-13113)
* CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13249, OSSM-13250)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.
7.0 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le | — |
Threats
Impact
Moderate
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
8.1 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Rollup, a JavaScript module bundler. Insecure file name sanitization in the core engine allows an attacker to control output filenames, potentially through command-line interface (CLI) inputs, manual chunk aliases, or malicious plugins. By using directory traversal sequences (`../`), an attacker can overwrite files anywhere on the host filesystem where the build process has write permissions. This vulnerability can lead to persistent remote code execution (RCE) by overwriting critical system or user configuration files.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le | — |
Threats
Impact
Important
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
8.8 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application's failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific "Gadget" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.
9.0 (Critical)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
91 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Kiali 1.73.29 for Red Hat OpenShift Service Mesh 2.6 is now available.\nAn update is now available for Red Hat OpenShift Service Mesh 2.6. This advisory contains the RPM packages for the Kiali component.\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Kiali 1.73.29, for Red Hat OpenShift Service Mesh 2.6, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.\n\nSecurity Fix(es):\n\n* CVE-2025-61726 Memory exhaustion in query parameter parsing in net/url (OSSM-12470)\n* CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13225, OSSM-13226)\n* CVE-2025-68121 Unexpected session resumption in crypto/tls (OSSM-12553)\n* CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-12952)\n* CVE-2026-27606 Rollup: Remote Code Execution via Path Traversal Vulnerability (OSSM-12689)\n* CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-12891)\n* CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027) (OSSM-12970, OSSM-12971)\n* CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-12996)\n* CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13112, OSSM-13113)\n* CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13249, OSSM-13250)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8483",
"url": "https://access.redhat.com/errata/RHSA-2026:8483"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-61726",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-62718",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-68121",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27606",
"url": "https://access.redhat.com/security/cve/CVE-2026-27606"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29063",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29074",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40175",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4800",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification",
"url": "https://access.redhat.com/security/updates/classification"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8483.json"
}
],
"title": "Red Hat Security Advisory: Kiali 1.73.29 for Red Hat OpenShift Service Mesh 2.6",
"tracking": {
"current_release_date": "2026-07-02T19:19:01+00:00",
"generator": {
"date": "2026-07-02T19:19:01+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:8483",
"initial_release_date": "2026-04-16T13:44:17+00:00",
"revision_history": [
{
"date": "2026-04-16T13:44:17+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-16T13:44:28+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T19:19:01+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Service Mesh 2.6",
"product": {
"name": "Red Hat OpenShift Service Mesh 2.6",
"product_id": "Red Hat OpenShift Service Mesh 2.6",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:service_mesh:2.6::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Service Mesh"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel8@sha256%3Ad4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776191302"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel8@sha256%3A5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776202125"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel8@sha256%3A7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776191302"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel8@sha256%3A6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776202125"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel8@sha256%3Aecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776191302"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel8@sha256%3Ae7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776202125"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel8@sha256%3A56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776191302"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel8@sha256%3A2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776202125"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x as a component of Red Hat OpenShift Service Mesh 2.6",
"product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64 as a component of Red Hat OpenShift Service Mesh 2.6",
"product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64 as a component of Red Hat OpenShift Service Mesh 2.6",
"product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6",
"product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x as a component of Red Hat OpenShift Service Mesh 2.6",
"product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64 as a component of Red Hat OpenShift Service Mesh 2.6",
"product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64 as a component of Red Hat OpenShift Service Mesh 2.6",
"product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6",
"product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-61726",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:42.791305+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "RHBZ#2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://go.dev/cl/736712",
"url": "https://go.dev/cl/736712"
},
{
"category": "external",
"summary": "https://go.dev/issue/77101",
"url": "https://go.dev/issue/77101"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4341",
"url": "https://pkg.go.dev/vuln/GO-2026-4341"
}
],
"release_date": "2026-01-28T19:30:31.215000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T13:44:17+00:00",
"details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8483"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
},
{
"cve": "CVE-2025-62718",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-09T15:01:48.111177+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456913"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has limited impact due to combination of non-default conditions to exploit: the attacker must be able to control or influence URLs passed to axios in a server-side context, the application must have both `HTTP_PROXY` and `NO_PROXY` configured, and the proxy itself must be positioned to act on the misdirected traffic or have been compromised by the attacker to intercept the rerouted traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "RHBZ#2456913",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456913"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-62718",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1",
"url": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2",
"url": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df",
"url": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10661",
"url": "https://github.com/axios/axios/pull/10661"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"
}
],
"release_date": "2026-04-09T14:31:46.067000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T13:44:17+00:00",
"details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8483"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization"
},
{
"cve": "CVE-2025-68121",
"discovery_date": "2026-02-05T18:01:30.086058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437111"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "RHBZ#2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://go.dev/cl/737700",
"url": "https://go.dev/cl/737700"
},
{
"category": "external",
"summary": "https://go.dev/issue/77217",
"url": "https://go.dev/issue/77217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
"url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4337",
"url": "https://pkg.go.dev/vuln/GO-2026-4337"
}
],
"release_date": "2026-02-05T17:48:44.141000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T13:44:17+00:00",
"details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8483"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
},
{
"cve": "CVE-2026-4800",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-03-31T20:01:21.918257+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453496"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user\u0027s browser. Consequently, the attack surface is strictly restricted to the local browser environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "RHBZ#2453496",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
"url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
}
],
"release_date": "2026-03-31T19:25:55.987000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T13:44:17+00:00",
"details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8483"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T13:44:17+00:00",
"details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8483"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27606",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-02-25T04:01:24.449922+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2442530"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Rollup, a JavaScript module bundler. Insecure file name sanitization in the core engine allows an attacker to control output filenames, potentially through command-line interface (CLI) inputs, manual chunk aliases, or malicious plugins. By using directory traversal sequences (`../`), an attacker can overwrite files anywhere on the host filesystem where the build process has write permissions. This vulnerability can lead to persistent remote code execution (RCE) by overwriting critical system or user configuration files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27606"
},
{
"category": "external",
"summary": "RHBZ#2442530",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442530"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27606",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27606"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27606",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27606"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2",
"url": "https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e",
"url": "https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3",
"url": "https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/releases/tag/v2.80.0",
"url": "https://github.com/rollup/rollup/releases/tag/v2.80.0"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/releases/tag/v3.30.0",
"url": "https://github.com/rollup/rollup/releases/tag/v3.30.0"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/releases/tag/v4.59.0",
"url": "https://github.com/rollup/rollup/releases/tag/v4.59.0"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc",
"url": "https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc"
}
],
"release_date": "2026-02-25T02:08:06.682000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T13:44:17+00:00",
"details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8483"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability"
},
{
"cve": "CVE-2026-29063",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-06T19:00:57.982727+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445291"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this vulnerability requires that an attacker is able to provide arbitrary data to clients of this library in a way that calls the affected functions with data the attacker controls. In most deployments, the ability to provide data in this fashion requires that an attacker has some degree of privileges to access the affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "RHBZ#2445291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
}
],
"release_date": "2026-03-06T18:25:22.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T13:44:17+00:00",
"details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8483"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution"
},
{
"cve": "CVE-2026-29074",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-03-06T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445132"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application\u0027s failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "svgo: SVGO: Denial of Service via XML entity expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "RHBZ#2445132",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445132"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673",
"url": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673"
}
],
"release_date": "2026-03-06T07:23:05.716000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T13:44:17+00:00",
"details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8483"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "svgo: SVGO: Denial of Service via XML entity expansion"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T13:44:17+00:00",
"details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8483"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-40175",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-10T20:02:10.296601+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific \"Gadget\" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Axios library, a promise-based HTTP client, is susceptible to an Important prototype pollution vulnerability. This flaw, when combined with specific \"Gadget\" attack chains in third-party dependencies, can lead to remote code execution or full cloud compromise, including bypassing AWS IMDSv2.\n \nWith pollution check patch available in Axios gives an advantage, it remains vulnerable due to HTTP Header Sanitation and Server-Side Request Forgery threat.\n\nRed Hat products that incorporate the vulnerable Axios library are affected.\n\nThe openshift4/ose-monitoring-plugin-rhel9 container image is not vulnerable to this flaw. The affected component is used as a build-time dependency but it\u0027s not shipped in the final product, meaning the flaw is not present thus cannot be exploited in the container deployments.\n\nRegarding openshift4/ose-console for Product stream 4.12 and 4.13, the vulnerable component is present (indirect dependency), but the vulnerability is not exploitable in our case due to the browser runtime, where the required Node.js-specific attack vectors are not available. With this, the impact becomes low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "RHBZ#2457432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40175"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1",
"url": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10660",
"url": "https://github.com/axios/axios/pull/10660"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx",
"url": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx"
}
],
"release_date": "2026-04-10T19:23:52.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T13:44:17+00:00",
"details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
"product_ids": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8483"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
"Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Remote Code Execution via Prototype Pollution escalation"
}
]
}
RHSA-2026:8484
Vulnerability from csaf_redhat - Published: 2026-04-16 13:49 - Updated: 2026-07-02 19:19Summary
Red Hat Security Advisory: Kiali 2.4.15 for Red Hat OpenShift Service Mesh 3.0
Severity
Critical
Notes
Topic: Kiali 2.4.15 for Red Hat OpenShift Service Mesh 3.0 is now available.
An update is now available for Red Hat OpenShift Service Mesh 3.0. This advisory contains the RPM packages for the Kiali component.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Kiali 2.4.15, for Red Hat OpenShift Service Mesh 3.0, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.
Security Fix(es):
* CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13227, OSSM-13230)
* CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-12919)
* CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-12893, OSSM-12894)
* CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (OSSM-12973, OSSM-12974)
* CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-13005)
* CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13115, OSSM-13116)
* CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13252, OSSM-13253)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.
7.0 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
8.1 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
8.8 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application's failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific "Gadget" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.
9.0 (Critical)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
61 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Kiali 2.4.15 for Red Hat OpenShift Service Mesh 3.0 is now available.\nAn update is now available for Red Hat OpenShift Service Mesh 3.0. This advisory contains the RPM packages for the Kiali component.\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Kiali 2.4.15, for Red Hat OpenShift Service Mesh 3.0, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.\n\nSecurity Fix(es):\n\n* CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13227, OSSM-13230)\n* CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-12919)\n* CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-12893, OSSM-12894)\n* CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027) (OSSM-12973, OSSM-12974)\n* CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-13005)\n* CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13115, OSSM-13116)\n* CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13252, OSSM-13253)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8484",
"url": "https://access.redhat.com/errata/RHSA-2026:8484"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-62718",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29063",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29074",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40175",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4800",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification",
"url": "https://access.redhat.com/security/updates/classification"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8484.json"
}
],
"title": "Red Hat Security Advisory: Kiali 2.4.15 for Red Hat OpenShift Service Mesh 3.0",
"tracking": {
"current_release_date": "2026-07-02T19:19:02+00:00",
"generator": {
"date": "2026-07-02T19:19:02+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:8484",
"initial_release_date": "2026-04-16T13:49:55+00:00",
"revision_history": [
{
"date": "2026-04-16T13:49:55+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-16T13:50:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T19:19:02+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Service Mesh 3.0",
"product": {
"name": "Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:service_mesh:3.0::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Service Mesh"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151272"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151124"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3Acea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151272"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Add25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151124"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151272"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151124"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3Afa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151272"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151124"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64 as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64 as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64 as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64 as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-62718",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-09T15:01:48.111177+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456913"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has limited impact due to combination of non-default conditions to exploit: the attacker must be able to control or influence URLs passed to axios in a server-side context, the application must have both `HTTP_PROXY` and `NO_PROXY` configured, and the proxy itself must be positioned to act on the misdirected traffic or have been compromised by the attacker to intercept the rerouted traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "RHBZ#2456913",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456913"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-62718",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1",
"url": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2",
"url": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df",
"url": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10661",
"url": "https://github.com/axios/axios/pull/10661"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"
}
],
"release_date": "2026-04-09T14:31:46.067000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T13:49:55+00:00",
"details": "See Kiali 2.4.15 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8484"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization"
},
{
"cve": "CVE-2026-4800",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-03-31T20:01:21.918257+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453496"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user\u0027s browser. Consequently, the attack surface is strictly restricted to the local browser environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "RHBZ#2453496",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
"url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
}
],
"release_date": "2026-03-31T19:25:55.987000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T13:49:55+00:00",
"details": "See Kiali 2.4.15 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8484"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T13:49:55+00:00",
"details": "See Kiali 2.4.15 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8484"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-29063",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-06T19:00:57.982727+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445291"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this vulnerability requires that an attacker is able to provide arbitrary data to clients of this library in a way that calls the affected functions with data the attacker controls. In most deployments, the ability to provide data in this fashion requires that an attacker has some degree of privileges to access the affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "RHBZ#2445291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
}
],
"release_date": "2026-03-06T18:25:22.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T13:49:55+00:00",
"details": "See Kiali 2.4.15 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8484"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution"
},
{
"cve": "CVE-2026-29074",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-03-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445132"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application\u0027s failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "svgo: SVGO: Denial of Service via XML entity expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "RHBZ#2445132",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445132"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673",
"url": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673"
}
],
"release_date": "2026-03-06T07:23:05.716000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T13:49:55+00:00",
"details": "See Kiali 2.4.15 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8484"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "svgo: SVGO: Denial of Service via XML entity expansion"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T13:49:55+00:00",
"details": "See Kiali 2.4.15 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8484"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-40175",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-10T20:02:10.296601+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific \"Gadget\" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Axios library, a promise-based HTTP client, is susceptible to an Important prototype pollution vulnerability. This flaw, when combined with specific \"Gadget\" attack chains in third-party dependencies, can lead to remote code execution or full cloud compromise, including bypassing AWS IMDSv2.\n \nWith pollution check patch available in Axios gives an advantage, it remains vulnerable due to HTTP Header Sanitation and Server-Side Request Forgery threat.\n\nRed Hat products that incorporate the vulnerable Axios library are affected.\n\nThe openshift4/ose-monitoring-plugin-rhel9 container image is not vulnerable to this flaw. The affected component is used as a build-time dependency but it\u0027s not shipped in the final product, meaning the flaw is not present thus cannot be exploited in the container deployments.\n\nRegarding openshift4/ose-console for Product stream 4.12 and 4.13, the vulnerable component is present (indirect dependency), but the vulnerability is not exploitable in our case due to the browser runtime, where the required Node.js-specific attack vectors are not available. With this, the impact becomes low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "RHBZ#2457432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40175"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1",
"url": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10660",
"url": "https://github.com/axios/axios/pull/10660"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx",
"url": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx"
}
],
"release_date": "2026-04-10T19:23:52.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T13:49:55+00:00",
"details": "See Kiali 2.4.15 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8484"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:050ae2cf325aaac9bd5b3d2bc6ed3f021120870e53350a76f0639fef137f94d6_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:483c69a961bb2a8c634ad8714eae527bb90ab069a4675d4b7f5d3c9e7d0967ba_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:90993dd0e36bb81ef2f1bdf0b4bedcf7e38ac306430bb00dbfc8073e71469413_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dd25f7254df085c0a07ab0c201708421f25c7723b8949c417a16c502665e3582_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:30b527ebc5f4f58fc10a86c7261a87552601edf8b184058f8e34a5f3b51df69a_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:58a964558cc55d38fa87d06c6e9227f99a541e8990d42ef9338db331c38558ed_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cea8f8cfbad86373b6429885178d4f0801977dadf34cec5c467e77869bc00be6_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fa805db56492d577764b08d3aafa881f7e22165135a1c0afafa6c9115fbcf534_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Remote Code Execution via Prototype Pollution escalation"
}
]
}
RHSA-2026:8490
Vulnerability from csaf_redhat - Published: 2026-04-16 14:03 - Updated: 2026-07-02 19:19Summary
Red Hat Security Advisory: Kiali 2.11.9 for Red Hat OpenShift Service Mesh 3.1
Severity
Critical
Notes
Topic: Kiali 2.11.9 for Red Hat OpenShift Service Mesh 3.1 is now available.
An update is now available for Red Hat OpenShift Service Mesh 3.1. This advisory contains the RPM packages for the Kiali component.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Kiali 2.11.9, for Red Hat OpenShift Service Mesh 3.1, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.
Security Fix(es):
* CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13231, OSSM-13234)
* CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-12921)
* CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-12897, OSSM-12898)
* CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (OSSM-12977, OSSM-12978)
* CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-13012)
* CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13119, OSSM-13120)
* CVE-2026-34986 Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (OSSM-13147)
* CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13256, OSSM-13257)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.
7.0 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
8.1 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
8.8 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application's failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific "Gadget" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.
9.0 (Critical)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
68 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Kiali 2.11.9 for Red Hat OpenShift Service Mesh 3.1 is now available.\nAn update is now available for Red Hat OpenShift Service Mesh 3.1. This advisory contains the RPM packages for the Kiali component.\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Kiali 2.11.9, for Red Hat OpenShift Service Mesh 3.1, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.\n\nSecurity Fix(es):\n\n* CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13231, OSSM-13234)\n* CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-12921)\n* CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-12897, OSSM-12898)\n* CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027) (OSSM-12977, OSSM-12978)\n* CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-13012)\n* CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13119, OSSM-13120)\n* CVE-2026-34986 Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (OSSM-13147)\n* CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13256, OSSM-13257)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8490",
"url": "https://access.redhat.com/errata/RHSA-2026:8490"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-62718",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29063",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29074",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40175",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4800",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification",
"url": "https://access.redhat.com/security/updates/classification"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8490.json"
}
],
"title": "Red Hat Security Advisory: Kiali 2.11.9 for Red Hat OpenShift Service Mesh 3.1",
"tracking": {
"current_release_date": "2026-07-02T19:19:02+00:00",
"generator": {
"date": "2026-07-02T19:19:02+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:8490",
"initial_release_date": "2026-04-16T14:03:40+00:00",
"revision_history": [
{
"date": "2026-04-16T14:03:40+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-16T14:03:44+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T19:19:02+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Service Mesh 3.1",
"product": {
"name": "Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:service_mesh:3.1::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Service Mesh"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3Af16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151270"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151106"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3Af341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151270"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Adf2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151106"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151270"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151106"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3Afd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151270"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Ae419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151106"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64 as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64 as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64 as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64 as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-62718",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-09T15:01:48.111177+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456913"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has limited impact due to combination of non-default conditions to exploit: the attacker must be able to control or influence URLs passed to axios in a server-side context, the application must have both `HTTP_PROXY` and `NO_PROXY` configured, and the proxy itself must be positioned to act on the misdirected traffic or have been compromised by the attacker to intercept the rerouted traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "RHBZ#2456913",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456913"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-62718",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1",
"url": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2",
"url": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df",
"url": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10661",
"url": "https://github.com/axios/axios/pull/10661"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"
}
],
"release_date": "2026-04-09T14:31:46.067000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:03:40+00:00",
"details": "See Kiali 2.11.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8490"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization"
},
{
"cve": "CVE-2026-4800",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-03-31T20:01:21.918257+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453496"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user\u0027s browser. Consequently, the attack surface is strictly restricted to the local browser environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "RHBZ#2453496",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
"url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
}
],
"release_date": "2026-03-31T19:25:55.987000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:03:40+00:00",
"details": "See Kiali 2.11.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8490"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:03:40+00:00",
"details": "See Kiali 2.11.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8490"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-29063",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-06T19:00:57.982727+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445291"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this vulnerability requires that an attacker is able to provide arbitrary data to clients of this library in a way that calls the affected functions with data the attacker controls. In most deployments, the ability to provide data in this fashion requires that an attacker has some degree of privileges to access the affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "RHBZ#2445291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
}
],
"release_date": "2026-03-06T18:25:22.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:03:40+00:00",
"details": "See Kiali 2.11.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8490"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution"
},
{
"cve": "CVE-2026-29074",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-03-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445132"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application\u0027s failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "svgo: SVGO: Denial of Service via XML entity expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "RHBZ#2445132",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445132"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673",
"url": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673"
}
],
"release_date": "2026-03-06T07:23:05.716000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:03:40+00:00",
"details": "See Kiali 2.11.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8490"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "svgo: SVGO: Denial of Service via XML entity expansion"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:03:40+00:00",
"details": "See Kiali 2.11.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8490"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:03:40+00:00",
"details": "See Kiali 2.11.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8490"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
},
{
"cve": "CVE-2026-40175",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-10T20:02:10.296601+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific \"Gadget\" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Axios library, a promise-based HTTP client, is susceptible to an Important prototype pollution vulnerability. This flaw, when combined with specific \"Gadget\" attack chains in third-party dependencies, can lead to remote code execution or full cloud compromise, including bypassing AWS IMDSv2.\n \nWith pollution check patch available in Axios gives an advantage, it remains vulnerable due to HTTP Header Sanitation and Server-Side Request Forgery threat.\n\nRed Hat products that incorporate the vulnerable Axios library are affected.\n\nThe openshift4/ose-monitoring-plugin-rhel9 container image is not vulnerable to this flaw. The affected component is used as a build-time dependency but it\u0027s not shipped in the final product, meaning the flaw is not present thus cannot be exploited in the container deployments.\n\nRegarding openshift4/ose-console for Product stream 4.12 and 4.13, the vulnerable component is present (indirect dependency), but the vulnerability is not exploitable in our case due to the browser runtime, where the required Node.js-specific attack vectors are not available. With this, the impact becomes low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "RHBZ#2457432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40175"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1",
"url": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10660",
"url": "https://github.com/axios/axios/pull/10660"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx",
"url": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx"
}
],
"release_date": "2026-04-10T19:23:52.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:03:40+00:00",
"details": "See Kiali 2.11.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8490"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2286c9f07dee34f8a52aacbedbc545e513264b78372ed34e236ec9331d3aed20_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4c7def4937e5f0bb2910816ee95499f7986f1ab7e3a97d488233f57beebec7fd_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:df2ebf49de4448adb5aff51c23ba848436f3fdf0fb498b46e19d2a11a09e6f0d_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e419454c0ecc585545d8f133c627939f15f3b3bbf545c6c073a4d700d4496c32_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8d573425eaf37eb78aec16ce191ee6d2e6232f2e022d4f2a10e0f34546b3e30c_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f16079699557aa847cf4b51fe623f22bf2f0154b4146f0cd305019645af68292_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f341c0b4ba1f5c8a7588c62574b854c835f88e700a38a91999af285a3b2c88ff_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fd0468b0ceacbf829ad8a0565c16417aa8ddc2d4ed91cd8fc9236173f8bcae54_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Remote Code Execution via Prototype Pollution escalation"
}
]
}
RHSA-2026:8491
Vulnerability from csaf_redhat - Published: 2026-04-16 14:30 - Updated: 2026-07-02 19:19Summary
Red Hat Security Advisory: Kiali 2.17.6 for Red Hat OpenShift Service Mesh 3.2
Severity
Critical
Notes
Topic: Kiali 2.17.6 for Red Hat OpenShift Service Mesh 3.2 is now available.
An update is now available for Red Hat OpenShift Service Mesh 3.2. This advisory contains the RPM packages for the Kiali component.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Kiali 2.17.6, for Red Hat OpenShift Service Mesh 3.2, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.
Security Fix(es):
* CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13235, OSSM-13236)
* CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-12922)
* CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-12900, OSSM-12901)
* CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (OSSM-12980, OSSM-12981)
* CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-13018)
* CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13122, OSSM-13123)
* CVE-2026-34986 Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (OSSM-13162)
* CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13259, OSSM-13260)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.
7.0 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
8.1 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
8.8 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application's failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific "Gadget" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.
9.0 (Critical)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
68 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Kiali 2.17.6 for Red Hat OpenShift Service Mesh 3.2 is now available.\nAn update is now available for Red Hat OpenShift Service Mesh 3.2. This advisory contains the RPM packages for the Kiali component.\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Kiali 2.17.6, for Red Hat OpenShift Service Mesh 3.2, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.\n\nSecurity Fix(es):\n\n* CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13235, OSSM-13236)\n* CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-12922)\n* CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-12900, OSSM-12901)\n* CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027) (OSSM-12980, OSSM-12981)\n* CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-13018)\n* CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13122, OSSM-13123)\n* CVE-2026-34986 Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (OSSM-13162)\n* CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13259, OSSM-13260)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8491",
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-62718",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29063",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29074",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40175",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4800",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification",
"url": "https://access.redhat.com/security/updates/classification"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8491.json"
}
],
"title": "Red Hat Security Advisory: Kiali 2.17.6 for Red Hat OpenShift Service Mesh 3.2",
"tracking": {
"current_release_date": "2026-07-02T19:19:04+00:00",
"generator": {
"date": "2026-07-02T19:19:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:8491",
"initial_release_date": "2026-04-16T14:30:52+00:00",
"revision_history": [
{
"date": "2026-04-16T14:30:52+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-16T14:31:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T19:19:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Service Mesh 3.2",
"product": {
"name": "Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:service_mesh:3.2::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Service Mesh"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776149682"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Ae43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776155669"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776149682"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776155669"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3Ada74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776149682"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776155669"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776149682"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776155669"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-62718",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-09T15:01:48.111177+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456913"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has limited impact due to combination of non-default conditions to exploit: the attacker must be able to control or influence URLs passed to axios in a server-side context, the application must have both `HTTP_PROXY` and `NO_PROXY` configured, and the proxy itself must be positioned to act on the misdirected traffic or have been compromised by the attacker to intercept the rerouted traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "RHBZ#2456913",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456913"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-62718",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1",
"url": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2",
"url": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df",
"url": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10661",
"url": "https://github.com/axios/axios/pull/10661"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"
}
],
"release_date": "2026-04-09T14:31:46.067000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:30:52+00:00",
"details": "See Kiali 2.17.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization"
},
{
"cve": "CVE-2026-4800",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-03-31T20:01:21.918257+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453496"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user\u0027s browser. Consequently, the attack surface is strictly restricted to the local browser environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "RHBZ#2453496",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
"url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
}
],
"release_date": "2026-03-31T19:25:55.987000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:30:52+00:00",
"details": "See Kiali 2.17.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:30:52+00:00",
"details": "See Kiali 2.17.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-29063",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-06T19:00:57.982727+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445291"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this vulnerability requires that an attacker is able to provide arbitrary data to clients of this library in a way that calls the affected functions with data the attacker controls. In most deployments, the ability to provide data in this fashion requires that an attacker has some degree of privileges to access the affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "RHBZ#2445291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
}
],
"release_date": "2026-03-06T18:25:22.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:30:52+00:00",
"details": "See Kiali 2.17.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution"
},
{
"cve": "CVE-2026-29074",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-03-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445132"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application\u0027s failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "svgo: SVGO: Denial of Service via XML entity expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "RHBZ#2445132",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445132"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673",
"url": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673"
}
],
"release_date": "2026-03-06T07:23:05.716000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:30:52+00:00",
"details": "See Kiali 2.17.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "svgo: SVGO: Denial of Service via XML entity expansion"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:30:52+00:00",
"details": "See Kiali 2.17.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:30:52+00:00",
"details": "See Kiali 2.17.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
},
{
"cve": "CVE-2026-40175",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-10T20:02:10.296601+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific \"Gadget\" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Axios library, a promise-based HTTP client, is susceptible to an Important prototype pollution vulnerability. This flaw, when combined with specific \"Gadget\" attack chains in third-party dependencies, can lead to remote code execution or full cloud compromise, including bypassing AWS IMDSv2.\n \nWith pollution check patch available in Axios gives an advantage, it remains vulnerable due to HTTP Header Sanitation and Server-Side Request Forgery threat.\n\nRed Hat products that incorporate the vulnerable Axios library are affected.\n\nThe openshift4/ose-monitoring-plugin-rhel9 container image is not vulnerable to this flaw. The affected component is used as a build-time dependency but it\u0027s not shipped in the final product, meaning the flaw is not present thus cannot be exploited in the container deployments.\n\nRegarding openshift4/ose-console for Product stream 4.12 and 4.13, the vulnerable component is present (indirect dependency), but the vulnerability is not exploitable in our case due to the browser runtime, where the required Node.js-specific attack vectors are not available. With this, the impact becomes low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "RHBZ#2457432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40175"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1",
"url": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10660",
"url": "https://github.com/axios/axios/pull/10660"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx",
"url": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx"
}
],
"release_date": "2026-04-10T19:23:52.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:30:52+00:00",
"details": "See Kiali 2.17.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Remote Code Execution via Prototype Pollution escalation"
}
]
}
RHSA-2026:8493
Vulnerability from csaf_redhat - Published: 2026-04-16 14:41 - Updated: 2026-07-02 19:19Summary
Red Hat Security Advisory: Kiali 2.22.2 for Red Hat OpenShift Service Mesh 3.3
Severity
Critical
Notes
Topic: Kiali 2.22.2 for Red Hat OpenShift Service Mesh 3.3 is now available.
An update is now available for Red Hat OpenShift Service Mesh 3.3. This advisory contains the RPM packages for the Kiali component.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Kiali 2.22.2, for Red Hat OpenShift Service Mesh 3.3, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.
Security Fix(es):
* CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13237, OSSM-13238)
* CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-13272)
* CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-13274, OSSM-13275)
* CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (OSSM-13276, OSSM-13277, OSSM-13278)
* CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-13279, OSSM-13280)
* CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13281, OSSM-13282)
* CVE-2026-34986 Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (OSSM-13283)
* CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13284, OSSM-13285)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.
7.0 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
8.1 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 | — |
Workaround
|
Threats
Impact
Important
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
8.8 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 | — |
Vendor Fix
fix
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 | — |
Threats
Impact
Important
A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application's failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific "Gadget" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.
9.0 (Critical)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 | — |
Vendor Fix
fix
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 | — |
Threats
Impact
Important
References
68 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Kiali 2.22.2 for Red Hat OpenShift Service Mesh 3.3 is now available.\nAn update is now available for Red Hat OpenShift Service Mesh 3.3. This advisory contains the RPM packages for the Kiali component.\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Kiali 2.22.2, for Red Hat OpenShift Service Mesh 3.3, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.\n\nSecurity Fix(es):\n\n* CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13237, OSSM-13238)\n* CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-13272)\n* CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-13274, OSSM-13275)\n* CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027) (OSSM-13276, OSSM-13277, OSSM-13278)\n* CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-13279, OSSM-13280)\n* CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13281, OSSM-13282)\n* CVE-2026-34986 Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (OSSM-13283)\n* CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13284, OSSM-13285)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8493",
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-62718",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29063",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29074",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40175",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4800",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification",
"url": "https://access.redhat.com/security/updates/classification"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8493.json"
}
],
"title": "Red Hat Security Advisory: Kiali 2.22.2 for Red Hat OpenShift Service Mesh 3.3",
"tracking": {
"current_release_date": "2026-07-02T19:19:04+00:00",
"generator": {
"date": "2026-07-02T19:19:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:8493",
"initial_release_date": "2026-04-16T14:41:31+00:00",
"revision_history": [
{
"date": "2026-04-16T14:41:31+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-16T14:41:38+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T19:19:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Service Mesh 3.3",
"product": {
"name": "Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:service_mesh:3.3::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Service Mesh"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3Adaa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151277"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-operator-bundle@sha256%3Ac93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776225903"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9-operator@sha256%3A69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151094"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151134"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3Ace46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151277"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9-operator@sha256%3Aa69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151094"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Afe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151134"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151277"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9-operator@sha256%3A8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151094"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Aea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151134"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151277"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9-operator@sha256%3A202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151094"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Afd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151134"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-62718",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-09T15:01:48.111177+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456913"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has limited impact due to combination of non-default conditions to exploit: the attacker must be able to control or influence URLs passed to axios in a server-side context, the application must have both `HTTP_PROXY` and `NO_PROXY` configured, and the proxy itself must be positioned to act on the misdirected traffic or have been compromised by the attacker to intercept the rerouted traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "RHBZ#2456913",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456913"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-62718",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1",
"url": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2",
"url": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df",
"url": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10661",
"url": "https://github.com/axios/axios/pull/10661"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"
}
],
"release_date": "2026-04-09T14:31:46.067000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:41:31+00:00",
"details": "See Kiali 2.22.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization"
},
{
"cve": "CVE-2026-4800",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-03-31T20:01:21.918257+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453496"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user\u0027s browser. Consequently, the attack surface is strictly restricted to the local browser environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "RHBZ#2453496",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
"url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
}
],
"release_date": "2026-03-31T19:25:55.987000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:41:31+00:00",
"details": "See Kiali 2.22.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:41:31+00:00",
"details": "See Kiali 2.22.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-29063",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-06T19:00:57.982727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445291"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this vulnerability requires that an attacker is able to provide arbitrary data to clients of this library in a way that calls the affected functions with data the attacker controls. In most deployments, the ability to provide data in this fashion requires that an attacker has some degree of privileges to access the affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "RHBZ#2445291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
}
],
"release_date": "2026-03-06T18:25:22.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:41:31+00:00",
"details": "See Kiali 2.22.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution"
},
{
"cve": "CVE-2026-29074",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-03-06T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445132"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application\u0027s failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "svgo: SVGO: Denial of Service via XML entity expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "RHBZ#2445132",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445132"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673",
"url": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673"
}
],
"release_date": "2026-03-06T07:23:05.716000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:41:31+00:00",
"details": "See Kiali 2.22.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "svgo: SVGO: Denial of Service via XML entity expansion"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:41:31+00:00",
"details": "See Kiali 2.22.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:41:31+00:00",
"details": "See Kiali 2.22.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
},
{
"cve": "CVE-2026-40175",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-10T20:02:10.296601+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific \"Gadget\" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Axios library, a promise-based HTTP client, is susceptible to an Important prototype pollution vulnerability. This flaw, when combined with specific \"Gadget\" attack chains in third-party dependencies, can lead to remote code execution or full cloud compromise, including bypassing AWS IMDSv2.\n \nWith pollution check patch available in Axios gives an advantage, it remains vulnerable due to HTTP Header Sanitation and Server-Side Request Forgery threat.\n\nRed Hat products that incorporate the vulnerable Axios library are affected.\n\nThe openshift4/ose-monitoring-plugin-rhel9 container image is not vulnerable to this flaw. The affected component is used as a build-time dependency but it\u0027s not shipped in the final product, meaning the flaw is not present thus cannot be exploited in the container deployments.\n\nRegarding openshift4/ose-console for Product stream 4.12 and 4.13, the vulnerable component is present (indirect dependency), but the vulnerability is not exploitable in our case due to the browser runtime, where the required Node.js-specific attack vectors are not available. With this, the impact becomes low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "RHBZ#2457432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40175"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1",
"url": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10660",
"url": "https://github.com/axios/axios/pull/10660"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx",
"url": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx"
}
],
"release_date": "2026-04-10T19:23:52.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:41:31+00:00",
"details": "See Kiali 2.22.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Remote Code Execution via Prototype Pollution escalation"
}
]
}
RHSA-2026:9742
Vulnerability from csaf_redhat - Published: 2026-04-22 14:56 - Updated: 2026-07-02 13:42Summary
Red Hat Security Advisory: Red Hat Developer Hub 1.8.6 release.
Severity
Critical
Notes
Topic: Red Hat Developer Hub 1.8.6 has been released.
Details: Red Hat Developer Hub (RHDH) is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters (AKS, EKS, GKE). The core features of RHDH include a single pane of glass, a centralized software catalog, self-service via golden path templates, and Tech Docs. RHDH is extensible by plugins.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.
7.0 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Python-Markdown. Parsing crafted markdown content containing malformed HTML-like sequences causes html.parser.HTMLParser to raise an unhandled AssertionError. This unhandled exception allows an attacker to cause an application crash and potentially disclose sensitive information via its stack trace.
8.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in ajv. When the $data option is enabled, the value of the pattern keyword is passed directly to the JavaScript RegExp() constructor without sufficient validation. An attacker able to supply a malicious regular expression pattern can trigger a ReDoS (Regular Expression Denial of Service), causing the application to become unresponsive and resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in undici, a Node.js HTTP/1.1 client. A remote attacker could exploit this vulnerability by sending HTTP/1.1 requests that include duplicate Content-Length headers with different casing (e.g., "Content-Length" and "content-length"). This can lead to HTTP Request Smuggling, a technique where an attacker sends an ambiguous request that is interpreted differently by a proxy and a backend server. Successful exploitation could result in unauthorized access, cache poisoning, or credential hijacking. It may also cause a Denial of Service (DoS) if strict HTTP parsers reject the malformed requests.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in undici. A remote attacker can exploit this vulnerability by sending a specially crafted compressed frame, known as a "decompression bomb," during permessage-deflate decompression. The undici WebSocket client does not properly limit the size of decompressed data, leading to unbounded memory consumption. This can cause the Node.js process to exhaust available memory, resulting in a denial of service (DoS) where the process crashes or becomes unresponsive.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in undici. A remote attacker could exploit this vulnerability by sending a specially crafted WebSocket frame with an extremely large 64-bit length. This causes undici's ByteParser to overflow its internal calculations, leading to an invalid state and a fatal TypeError. The primary consequence is a Denial of Service (DoS), which terminates the process.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the undici WebSocket client. A remote malicious server can exploit this vulnerability by sending a WebSocket frame with an invalid `server_max_window_bits` parameter within the permessage-deflate extension. This improper validation causes the client's Node.js process to terminate, leading to a denial-of-service (DoS) condition for the client.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Important
A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to insufficient input validation in GraphQL query handling. An authenticated user can inject specially crafted input into API requests, which disrupts backend query processing. This results in the entire Backstage application crashing and restarting, leading to a platform-wide Denial of Service (DoS). As a result, legitimate users temporarily lose access to the platform.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by providing specially crafted input that generates a regular expression with multiple sequential optional groups. This leads to an exponential growth in the generated regular expression, causing a Denial of Service (DoS) due to excessive resource consumption.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Important
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — | ||
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Threats
Impact
Moderate
A flaw was found in Underscore.js, a JavaScript utility library. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) attack by providing specially crafted recursive data structures. When these structures are processed by the _.flatten or _.isEqual functions, which lack a depth limit for recursion, a stack overflow occurs. This can make the application unavailable to legitimate users.
5.9 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — | ||
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Threats
Impact
Moderate
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — | ||
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Threats
Impact
Important
A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application's failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Backstage. The backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an mkdocs.yml file that causes arbitrary Python code execution.
9.1 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Important
A denial of service flaw has been discovered in the flatted npm library. flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in fast-xml-parser. A remote attacker can exploit this vulnerability by supplying specially crafted XML input containing numeric character references or standard XML entities. This input can bypass configured entity expansion limits, leading to excessive memory allocation and high CPU usage. The primary consequence is a Denial of Service (DoS), which can crash the affected process.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in flatted, a JavaScript Object Notation (JSON) parser designed for handling circular data structures. A remote attacker can exploit this vulnerability by providing specially crafted JSON input. The parse() function in flatted fails to properly validate string values used as array index keys, allowing an attacker to manipulate internal JavaScript object prototypes. This prototype pollution can enable an attacker to execute arbitrary code or cause a denial of service, impacting the availability and integrity of affected systems.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — | ||
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Threats
Impact
Critical
A flaw was found in the node-forge library, a JavaScript implementation of Transport Layer Security. This vulnerability, inherited from the bundled jsbn library, allows a remote attacker to cause a Denial of Service (DoS). When the BigInteger.modInverse() function is called with a zero value, it enters an infinite loop, causing the process to hang indefinitely and consume 100% of the CPU resources.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Forge (also called `node-forge`), a JavaScript implementation of Transport Layer Security. A remote attacker could exploit weaknesses in the RSASSA PKCS#1 v1.5 signature verification process. By crafting malicious signatures that include extra data within the ASN structure and do not meet padding requirements, an attacker can bypass signature validation. This allows for the creation of forged signatures that appear legitimate, potentially compromising the integrity and authenticity of communications.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Forge (also called `node-forge`), a JavaScript library used for Transport Layer Security (TLS). The library's Ed25519 signature verification process does not correctly validate cryptographic signatures, allowing forged non-canonical signatures to be accepted. A remote attacker could exploit this signature malleability to bypass authentication and authorization logic. This vulnerability can also circumvent security checks in applications that rely on the uniqueness of cryptographic signatures for functions such as deduplication or preventing replay attacks.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Forge (also known as node-forge), a JavaScript implementation of Transport Layer Security (TLS). The `pki.verifyCertificateChain()` function does not properly enforce certificate validation rules. This oversight allows an intermediate certificate that lacks specific security extensions to enable any leaf certificate to function as a Certificate Authority (CA) and sign other certificates. Consequently, node-forge could accept these unauthorized certificates as valid, potentially leading to spoofing or the issuance of illegitimate certificates.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in basic-ftp, an FTP client for Node.js. A remote attacker can exploit this vulnerability by injecting Carriage Return Line Feed (CRLF) sequences into file path parameters used by high-level APIs. This allows the attacker to split a single intended FTP command into multiple commands. Such command injection can lead to the execution of arbitrary commands, potentially compromising the integrity and availability of data or the system.
8.6 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific "Gadget" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.
9.0 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 | — |
Vendor Fix
fix
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 | — | ||
| Unresolved product id: Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 | — |
Threats
Impact
Important
References
228 references
Acknowledgments
Thibault Guittet
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Developer Hub 1.8.6 has been released.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Developer Hub (RHDH) is Red Hat\u0027s enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters (AKS, EKS, GKE). The core features of RHDH include a single pane of glass, a centralized software catalog, self-service via golden path templates, and Tech Docs. RHDH is extensible by plugins.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:9742",
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-62718",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-69534",
"url": "https://access.redhat.com/security/cve/CVE-2025-69534"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-69873",
"url": "https://access.redhat.com/security/cve/CVE-2025-69873"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1525",
"url": "https://access.redhat.com/security/cve/CVE-2026-1525"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1526",
"url": "https://access.redhat.com/security/cve/CVE-2026-1526"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1528",
"url": "https://access.redhat.com/security/cve/CVE-2026-1528"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2229",
"url": "https://access.redhat.com/security/cve/CVE-2026-2229"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-26996",
"url": "https://access.redhat.com/security/cve/CVE-2026-26996"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27601",
"url": "https://access.redhat.com/security/cve/CVE-2026-27601"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27904",
"url": "https://access.redhat.com/security/cve/CVE-2026-27904"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29063",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29074",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29186",
"url": "https://access.redhat.com/security/cve/CVE-2026-29186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3118",
"url": "https://access.redhat.com/security/cve/CVE-2026-3118"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32141",
"url": "https://access.redhat.com/security/cve/CVE-2026-32141"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33036",
"url": "https://access.redhat.com/security/cve/CVE-2026-33036"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33228",
"url": "https://access.redhat.com/security/cve/CVE-2026-33228"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33891",
"url": "https://access.redhat.com/security/cve/CVE-2026-33891"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33894",
"url": "https://access.redhat.com/security/cve/CVE-2026-33894"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33895",
"url": "https://access.redhat.com/security/cve/CVE-2026-33895"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33896",
"url": "https://access.redhat.com/security/cve/CVE-2026-33896"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39983",
"url": "https://access.redhat.com/security/cve/CVE-2026-39983"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40175",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4800",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4926",
"url": "https://access.redhat.com/security/cve/CVE-2026-4926"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://catalog.redhat.com/search?gs\u0026searchType=containers\u0026q=rhdh",
"url": "https://catalog.redhat.com/search?gs\u0026searchType=containers\u0026q=rhdh"
},
{
"category": "external",
"summary": "https://developers.redhat.com/rhdh/overview",
"url": "https://developers.redhat.com/rhdh/overview"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_developer_hub",
"url": "https://docs.redhat.com/en/documentation/red_hat_developer_hub"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHDHBUGS-2288",
"url": "https://issues.redhat.com/browse/RHDHBUGS-2288"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHDHBUGS-2947",
"url": "https://issues.redhat.com/browse/RHDHBUGS-2947"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHDHBUGS-2972",
"url": "https://issues.redhat.com/browse/RHDHBUGS-2972"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-12327",
"url": "https://issues.redhat.com/browse/RHIDP-12327"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-12388",
"url": "https://issues.redhat.com/browse/RHIDP-12388"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-12419",
"url": "https://issues.redhat.com/browse/RHIDP-12419"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-12511",
"url": "https://issues.redhat.com/browse/RHIDP-12511"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-12568",
"url": "https://issues.redhat.com/browse/RHIDP-12568"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-12647",
"url": "https://issues.redhat.com/browse/RHIDP-12647"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-12650",
"url": "https://issues.redhat.com/browse/RHIDP-12650"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-12655",
"url": "https://issues.redhat.com/browse/RHIDP-12655"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-12666",
"url": "https://issues.redhat.com/browse/RHIDP-12666"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-12686",
"url": "https://issues.redhat.com/browse/RHIDP-12686"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-12784",
"url": "https://issues.redhat.com/browse/RHIDP-12784"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-12880",
"url": "https://issues.redhat.com/browse/RHIDP-12880"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-12887",
"url": "https://issues.redhat.com/browse/RHIDP-12887"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-12921",
"url": "https://issues.redhat.com/browse/RHIDP-12921"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-12930",
"url": "https://issues.redhat.com/browse/RHIDP-12930"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-12996",
"url": "https://issues.redhat.com/browse/RHIDP-12996"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-13105",
"url": "https://issues.redhat.com/browse/RHIDP-13105"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-13107",
"url": "https://issues.redhat.com/browse/RHIDP-13107"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-13130",
"url": "https://issues.redhat.com/browse/RHIDP-13130"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-13180",
"url": "https://issues.redhat.com/browse/RHIDP-13180"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-13182",
"url": "https://issues.redhat.com/browse/RHIDP-13182"
},
{
"category": "external",
"summary": "https://issues.redhat.com/browse/RHIDP-13185",
"url": "https://issues.redhat.com/browse/RHIDP-13185"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9742.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Developer Hub 1.8.6 release.",
"tracking": {
"current_release_date": "2026-07-02T13:42:38+00:00",
"generator": {
"date": "2026-07-02T13:42:38+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:9742",
"initial_release_date": "2026-04-22T14:56:38+00:00",
"revision_history": [
{
"date": "2026-04-22T14:56:38+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-22T14:56:41+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T13:42:38+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Developer Hub 1.8",
"product": {
"name": "Red Hat Developer Hub 1.8",
"product_id": "Red Hat Developer Hub 1.8",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhdh:1.8::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Developer Hub"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"product": {
"name": "registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"product_id": "registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/rhdh-hub-rhel9@sha256%3Abb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9?arch=amd64\u0026repository_url=registry.redhat.io/rhdh\u0026tag=1776784286"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64",
"product": {
"name": "registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64",
"product_id": "registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/rhdh-rhel9-operator@sha256%3Af09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c?arch=amd64\u0026repository_url=registry.redhat.io/rhdh\u0026tag=1776783947"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"product": {
"name": "registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"product_id": "registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"product_identification_helper": {
"purl": "pkg:oci/rhdh-operator-bundle@sha256%3Ab40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331?arch=amd64\u0026repository_url=registry.redhat.io/rhdh\u0026tag=1776787729"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64 as a component of Red Hat Developer Hub 1.8",
"product_id": "Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
},
"product_reference": "registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"relates_to_product_reference": "Red Hat Developer Hub 1.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64 as a component of Red Hat Developer Hub 1.8",
"product_id": "Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64"
},
"product_reference": "registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"relates_to_product_reference": "Red Hat Developer Hub 1.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64 as a component of Red Hat Developer Hub 1.8",
"product_id": "Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
},
"product_reference": "registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64",
"relates_to_product_reference": "Red Hat Developer Hub 1.8"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-62718",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-09T15:01:48.111177+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456913"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has limited impact due to combination of non-default conditions to exploit: the attacker must be able to control or influence URLs passed to axios in a server-side context, the application must have both `HTTP_PROXY` and `NO_PROXY` configured, and the proxy itself must be positioned to act on the misdirected traffic or have been compromised by the attacker to intercept the rerouted traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "RHBZ#2456913",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456913"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-62718",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1",
"url": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2",
"url": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df",
"url": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10661",
"url": "https://github.com/axios/axios/pull/10661"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"
}
],
"release_date": "2026-04-09T14:31:46.067000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization"
},
{
"cve": "CVE-2025-69534",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-03-05T16:01:10.432461+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444839"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Python-Markdown. Parsing crafted markdown content containing malformed HTML-like sequences causes html.parser.HTMLParser to raise an unhandled AssertionError. This unhandled exception allows an attacker to cause an application crash and potentially disclose sensitive information via its stack trace.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-markdown: denial of service via malformed HTML-like sequences",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be able to supply a specially crafted payload to be processed by an application using Python-Markdown. Additionally, the security impact of this vulnerability is limited to an information disclosure via the unhandled exception stack trace and a denial of service. There is no memory corruption or arbitrary command execution. Due to these reasons, this issue has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-69534"
},
{
"category": "external",
"summary": "RHBZ#2444839",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444839"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-69534",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69534"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-69534",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69534"
},
{
"category": "external",
"summary": "https://github.com/Python-Markdown/markdown",
"url": "https://github.com/Python-Markdown/markdown"
},
{
"category": "external",
"summary": "https://github.com/Python-Markdown/markdown/actions/runs/15736122892",
"url": "https://github.com/Python-Markdown/markdown/actions/runs/15736122892"
},
{
"category": "external",
"summary": "https://github.com/Python-Markdown/markdown/issues/1534",
"url": "https://github.com/Python-Markdown/markdown/issues/1534"
}
],
"release_date": "2026-03-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-markdown: denial of service via malformed HTML-like sequences"
},
{
"cve": "CVE-2025-69873",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-02-11T19:01:32.953264+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2439070"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ajv. When the $data option is enabled, the value of the pattern keyword is passed directly to the JavaScript RegExp() constructor without sufficient validation. An attacker able to supply a malicious regular expression pattern can trigger a ReDoS (Regular Expression Denial of Service), causing the application to become unresponsive and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ajv: ReDoS via $data reference",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, the $data option must be enabled and the attacker needs to be able to send a payload with a specially crafted regular expression to the application processing the input. A 31-character payload causes approximately 44 seconds of execution, with each additional character doubling the execution time. Therefore, even a small payload can cause an application to become unresponsive and eventually result in a denial of service. Due to this reason, this flaw has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-69873"
},
{
"category": "external",
"summary": "RHBZ#2439070",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439070"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-69873",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69873"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-69873",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69873"
},
{
"category": "external",
"summary": "https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md",
"url": "https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md"
}
],
"release_date": "2026-02-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable the $data feature if your application does not require it. If $data must be used, implement strict validation of the input fields that are referenced by the pattern keyword to ensure they contain only expected and safe characters.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ajv: ReDoS via $data reference"
},
{
"cve": "CVE-2026-1525",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-03-12T21:01:33.639277+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447144"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici, a Node.js HTTP/1.1 client. A remote attacker could exploit this vulnerability by sending HTTP/1.1 requests that include duplicate Content-Length headers with different casing (e.g., \"Content-Length\" and \"content-length\"). This can lead to HTTP Request Smuggling, a technique where an attacker sends an ambiguous request that is interpreted differently by a proxy and a backend server. Successful exploitation could result in unauthorized access, cache poisoning, or credential hijacking. It may also cause a Denial of Service (DoS) if strict HTTP parsers reject the malformed requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate impact. A flaw in the undici Node.js HTTP/1.1 client allows for HTTP Request Smuggling or Denial of Service. This can occur in Red Hat products that use undici and process HTTP requests where user-controlled header names are not case-normalized, or headers are passed as flat arrays.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1525"
},
{
"category": "external",
"summary": "RHBZ#2447144",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447144"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1525",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1525"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1525",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1525"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://cwe.mitre.org/data/definitions/444.html",
"url": "https://cwe.mitre.org/data/definitions/444.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3556037",
"url": "https://hackerone.com/reports/3556037"
},
{
"category": "external",
"summary": "https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6",
"url": "https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6"
}
],
"release_date": "2026-03-12T19:56:55.092000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers"
},
{
"cve": "CVE-2026-1526",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-03-12T21:01:25.538271+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447142"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A remote attacker can exploit this vulnerability by sending a specially crafted compressed frame, known as a \"decompression bomb,\" during permessage-deflate decompression. The undici WebSocket client does not properly limit the size of decompressed data, leading to unbounded memory consumption. This can cause the Node.js process to exhaust available memory, resulting in a denial of service (DoS) where the process crashes or becomes unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1526"
},
{
"category": "external",
"summary": "RHBZ#2447142",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447142"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1526"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1526",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1526"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc7692",
"url": "https://datatracker.ietf.org/doc/html/rfc7692"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3481206",
"url": "https://hackerone.com/reports/3481206"
}
],
"release_date": "2026-03-12T20:08:05.950000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression"
},
{
"cve": "CVE-2026-1528",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-03-12T21:01:36.954017+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447145"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A remote attacker could exploit this vulnerability by sending a specially crafted WebSocket frame with an extremely large 64-bit length. This causes undici\u0027s ByteParser to overflow its internal calculations, leading to an invalid state and a fatal TypeError. The primary consequence is a Denial of Service (DoS), which terminates the process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via crafted WebSocket frame with large length",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1528"
},
{
"category": "external",
"summary": "RHBZ#2447145",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1528",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1528"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1528",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1528"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3537648",
"url": "https://hackerone.com/reports/3537648"
}
],
"release_date": "2026-03-12T20:21:57.775000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Denial of Service via crafted WebSocket frame with large length"
},
{
"cve": "CVE-2026-2229",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-03-12T21:01:29.187989+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447143"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the undici WebSocket client. A remote malicious server can exploit this vulnerability by sending a WebSocket frame with an invalid `server_max_window_bits` parameter within the permessage-deflate extension. This improper validation causes the client\u0027s Node.js process to terminate, leading to a denial-of-service (DoS) condition for the client.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2229"
},
{
"category": "external",
"summary": "RHBZ#2447143",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2229",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2229"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2229",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2229"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc7692",
"url": "https://datatracker.ietf.org/doc/html/rfc7692"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3487486",
"url": "https://hackerone.com/reports/3487486"
},
{
"category": "external",
"summary": "https://nodejs.org/api/zlib.html#class-zlibinflateraw",
"url": "https://nodejs.org/api/zlib.html#class-zlibinflateraw"
}
],
"release_date": "2026-03-12T20:27:05.600000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter"
},
{
"acknowledgments": [
{
"names": [
"Thibault Guittet"
]
}
],
"cve": "CVE-2026-3118",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2026-02-24T12:08:42.955000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2442273"
}
],
"notes": [
{
"category": "description",
"text": "A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to insufficient input validation in GraphQL query handling. An authenticated user can inject specially crafted input into API requests, which disrupts backend query processing. This results in the entire Backstage application crashing and restarting, leading to a platform-wide Denial of Service (DoS). As a result, legitimate users temporarily lose access to the platform.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rhdh: GraphQL Injection Leading to Platform-Wide Denial of Service (DoS) in RH Developer Hub Orchestrator Plugin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This MODERATE impact vulnerability in the Orchestrator Plugin of Red Hat Developer Hub (Backstage) allows an authenticated attacker to cause a platform-wide Denial of Service. By injecting specially crafted input into GraphQL API requests, an attacker can disrupt backend query processing, leading to the application crashing and restarting. This issue temporarily prevents legitimate users from accessing the platform.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3118"
},
{
"category": "external",
"summary": "RHBZ#2442273",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442273"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3118"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3118",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3118"
}
],
"release_date": "2026-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to the Red Hat Developer Hub instance to trusted users and networks only. This limits the exposure of the vulnerable Orchestrator Plugin to unauthorized access.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rhdh: GraphQL Injection Leading to Platform-Wide Denial of Service (DoS) in RH Developer Hub Orchestrator Plugin"
},
{
"cve": "CVE-2026-4800",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-03-31T20:01:21.918257+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453496"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user\u0027s browser. Consequently, the attack surface is strictly restricted to the local browser environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "RHBZ#2453496",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
"url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
}
],
"release_date": "2026-03-31T19:25:55.987000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
},
{
"cve": "CVE-2026-4926",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-03-26T20:03:28.427630+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451867"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by providing specially crafted input that generates a regular expression with multiple sequential optional groups. This leads to an exponential growth in the generated regular expression, causing a Denial of Service (DoS) due to excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in `path-to-regexp` that can lead to a Denial of Service. The vulnerability occurs when specially crafted input containing multiple sequential optional groups is used to generate regular expressions, causing exponential resource consumption.\n\nThe Red Hat Advanced Cluster Security is not affected by this issue since it\u0027s shipping a `path-to-regexp` version which doesn\u0027t contain the vulnerable code.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4926"
},
{
"category": "external",
"summary": "RHBZ#2451867",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451867"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4926",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4926"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4926",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4926"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"release_date": "2026-03-26T18:59:38+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, limit the use of multiple sequential optional groups in route patterns within applications that use `path-to-regexp`. Additionally, avoid directly passing user-controlled input as route patterns to prevent the generation of maliciously crafted regular expressions.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-26996",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-02-20T04:01:11.896063+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2441268"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-26996"
},
{
"category": "external",
"summary": "RHBZ#2441268",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-26996",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-26996"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996"
},
{
"category": "external",
"summary": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5",
"url": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5"
},
{
"category": "external",
"summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26",
"url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"
}
],
"release_date": "2026-02-20T03:05:21.105000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "minimatch: minimatch: Denial of Service via specially crafted glob patterns"
},
{
"cve": "CVE-2026-27601",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-03-03T23:01:58.011378+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444247"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Underscore.js, a JavaScript utility library. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) attack by providing specially crafted recursive data structures. When these structures are processed by the _.flatten or _.isEqual functions, which lack a depth limit for recursion, a stack overflow occurs. This can make the application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Underscore.js: Underscore.js: Denial of Service via recursive data structures in flatten and isEqual functions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27601"
},
{
"category": "external",
"summary": "RHBZ#2444247",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444247"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27601"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27601",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27601"
},
{
"category": "external",
"summary": "https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4",
"url": "https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4"
},
{
"category": "external",
"summary": "https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84",
"url": "https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84"
},
{
"category": "external",
"summary": "https://github.com/jashkenas/underscore/security/advisories/GHSA-qpx9-hpmf-5gmw",
"url": "https://github.com/jashkenas/underscore/security/advisories/GHSA-qpx9-hpmf-5gmw"
}
],
"release_date": "2026-03-03T22:38:38.955000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications utilizing Underscore.js should ensure that any processing of untrusted, recursively structured data with `_.flatten` or `_.isEqual` explicitly enforces a finite depth limit. Review application code to identify and modify calls to these functions, adding appropriate depth parameters to prevent stack overflow conditions. Additionally, input validation should be implemented to sanitize untrusted data before it is processed by Underscore.js functions.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Underscore.js: Underscore.js: Denial of Service via recursive data structures in flatten and isEqual functions"
},
{
"cve": "CVE-2026-27904",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-02-26T02:01:23.004531+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2442922"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27904"
},
{
"category": "external",
"summary": "RHBZ#2442922",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27904",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27904"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904"
},
{
"category": "external",
"summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74",
"url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"
}
],
"release_date": "2026-02-26T01:07:42.693000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions"
},
{
"cve": "CVE-2026-29063",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-06T19:00:57.982727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445291"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this vulnerability requires that an attacker is able to provide arbitrary data to clients of this library in a way that calls the affected functions with data the attacker controls. In most deployments, the ability to provide data in this fashion requires that an attacker has some degree of privileges to access the affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "RHBZ#2445291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
}
],
"release_date": "2026-03-06T18:25:22.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution"
},
{
"cve": "CVE-2026-29074",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-03-06T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445132"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application\u0027s failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "svgo: SVGO: Denial of Service via XML entity expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "RHBZ#2445132",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445132"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673",
"url": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673"
}
],
"release_date": "2026-03-06T07:23:05.716000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "svgo: SVGO: Denial of Service via XML entity expansion"
},
{
"cve": "CVE-2026-29186",
"cwe": {
"id": "CWE-791",
"name": "Incomplete Filtering of Special Elements"
},
"discovery_date": "2026-03-07T16:01:40.949207+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445480"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Backstage. The backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an mkdocs.yml file that causes arbitrary Python code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "backstage/plugin-techdocs-node: TechDocs Mkdocs configuration key enables arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs commit access to a repository that Backstage is configured to track and build in order to introduce a malicious mkdocs.yml file into the TechDocs build pipeline. Additionally, an attacker can execute arbitrary Python code but the payload is confined by the permissions granted to the TechDocs build process which is typically a restricted service account, limiting the impact of this vulnerability. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29186"
},
{
"category": "external",
"summary": "RHBZ#2445480",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445480"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29186"
},
{
"category": "external",
"summary": "https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw",
"url": "https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw"
}
],
"release_date": "2026-03-07T15:03:51.422000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "To mitigate this issue, enable docker isolation by updating the Backstage configuration to use \u0027runIn: docker\u0027 instead of \u0027runIn: local\u0027, confining the arbitrary Python code execution to a containerized environment. Additionally, limit commit access to repositories tracked by Backstage to trusted contributors only, and enforce mandatory pull request (PR) reviews for any modifications made to the mkdocs.yml file.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "backstage/plugin-techdocs-node: TechDocs Mkdocs configuration key enables arbitrary code execution"
},
{
"cve": "CVE-2026-32141",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-03-12T19:01:30.987208+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447083"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw has been discovered in the flatted npm library. flatted\u0027s parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flatted: flatted: Unbounded recursion DoS in parse() revive phase",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32141"
},
{
"category": "external",
"summary": "RHBZ#2447083",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447083"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32141",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32141"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32141",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32141"
},
{
"category": "external",
"summary": "https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606",
"url": "https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606"
},
{
"category": "external",
"summary": "https://github.com/WebReflection/flatted/pull/88",
"url": "https://github.com/WebReflection/flatted/pull/88"
},
{
"category": "external",
"summary": "https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f",
"url": "https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f"
}
],
"release_date": "2026-03-12T18:08:09.634000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "flatted: flatted: Unbounded recursion DoS in parse() revive phase"
},
{
"cve": "CVE-2026-33036",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-03-20T06:02:18.306021+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449458"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in fast-xml-parser. A remote attacker can exploit this vulnerability by supplying specially crafted XML input containing numeric character references or standard XML entities. This input can bypass configured entity expansion limits, leading to excessive memory allocation and high CPU usage. The primary consequence is a Denial of Service (DoS), which can crash the affected process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33036"
},
{
"category": "external",
"summary": "RHBZ#2449458",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449458"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33036",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33036"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33036",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33036"
},
{
"category": "external",
"summary": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/bd26122c838e6a55e7d7ac49b4ccc01a49999a01",
"url": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/bd26122c838e6a55e7d7ac49b4ccc01a49999a01"
},
{
"category": "external",
"summary": "https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.5.6",
"url": "https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.5.6"
},
{
"category": "external",
"summary": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8gc5-j5rx-235r",
"url": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8gc5-j5rx-235r"
}
],
"release_date": "2026-03-20T05:17:03.290000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass"
},
{
"cve": "CVE-2026-33228",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-21T00:01:43.424803+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449872"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in flatted, a JavaScript Object Notation (JSON) parser designed for handling circular data structures. A remote attacker can exploit this vulnerability by providing specially crafted JSON input. The parse() function in flatted fails to properly validate string values used as array index keys, allowing an attacker to manipulate internal JavaScript object prototypes. This prototype pollution can enable an attacker to execute arbitrary code or cause a denial of service, impacting the availability and integrity of affected systems.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flatted: Flatted: Prototype pollution vulnerability allows arbitrary code execution via crafted JSON.",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A Critical vulnerability was discovered in \u0027flatted\u0027, a JavaScript JSON parser. It could enable a remote, unauthenticated attacker to execute arbitrary code or cause a denial of service. Exploitation involves prototype pollution by providing a specially crafted JSON input. Red Hat products that process un-trusted JSON data and utilize the \u0027flatted\u0027 library are at risk if they do not properly sanitize input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33228"
},
{
"category": "external",
"summary": "RHBZ#2449872",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449872"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33228",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33228"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33228",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33228"
},
{
"category": "external",
"summary": "https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802",
"url": "https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802"
},
{
"category": "external",
"summary": "https://github.com/WebReflection/flatted/releases/tag/v3.4.2",
"url": "https://github.com/WebReflection/flatted/releases/tag/v3.4.2"
},
{
"category": "external",
"summary": "https://github.com/WebReflection/flatted/security/advisories/GHSA-rf6f-7fwh-wjgh",
"url": "https://github.com/WebReflection/flatted/security/advisories/GHSA-rf6f-7fwh-wjgh"
}
],
"release_date": "2026-03-20T23:06:48.485000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flatted: Flatted: Prototype pollution vulnerability allows arbitrary code execution via crafted JSON."
},
{
"cve": "CVE-2026-33891",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-03-27T21:01:34.410210+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452450"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the node-forge library, a JavaScript implementation of Transport Layer Security. This vulnerability, inherited from the bundled jsbn library, allows a remote attacker to cause a Denial of Service (DoS). When the BigInteger.modInverse() function is called with a zero value, it enters an infinite loop, causing the process to hang indefinitely and consume 100% of the CPU resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33891"
},
{
"category": "external",
"summary": "RHBZ#2452450",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452450"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33891",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33891"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33891",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33891"
},
{
"category": "external",
"summary": "https://github.com/digitalbazaar/forge/commit/9bb8d67b99d17e4ebb5fd7596cd699e11f25d023",
"url": "https://github.com/digitalbazaar/forge/commit/9bb8d67b99d17e4ebb5fd7596cd699e11f25d023"
},
{
"category": "external",
"summary": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-5m6q-g25r-mvwx",
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-5m6q-g25r-mvwx"
}
],
"release_date": "2026-03-27T20:43:37.725000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse()"
},
{
"cve": "CVE-2026-33894",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-27T21:02:52.462999+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452464"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Forge (also called `node-forge`), a JavaScript implementation of Transport Layer Security. A remote attacker could exploit weaknesses in the RSASSA PKCS#1 v1.5 signature verification process. By crafting malicious signatures that include extra data within the ASN structure and do not meet padding requirements, an attacker can bypass signature validation. This allows for the creation of forged signatures that appear legitimate, potentially compromising the integrity and authenticity of communications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33894"
},
{
"category": "external",
"summary": "RHBZ#2452464",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452464"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33894",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33894"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33894",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33894"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc2313#section-8",
"url": "https://datatracker.ietf.org/doc/html/rfc2313#section-8"
},
{
"category": "external",
"summary": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp",
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp"
},
{
"category": "external",
"summary": "https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE",
"url": "https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE"
},
{
"category": "external",
"summary": "https://www.rfc-editor.org/rfc/rfc8017.html",
"url": "https://www.rfc-editor.org/rfc/rfc8017.html"
}
],
"release_date": "2026-03-27T20:45:49.583000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification"
},
{
"cve": "CVE-2026-33895",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-27T21:02:18.484291+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452457"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Forge (also called `node-forge`), a JavaScript library used for Transport Layer Security (TLS). The library\u0027s Ed25519 signature verification process does not correctly validate cryptographic signatures, allowing forged non-canonical signatures to be accepted. A remote attacker could exploit this signature malleability to bypass authentication and authorization logic. This vulnerability can also circumvent security checks in applications that rely on the uniqueness of cryptographic signatures for functions such as deduplication or preventing replay attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33895"
},
{
"category": "external",
"summary": "RHBZ#2452457",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452457"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33895",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33895"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33895",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33895"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc8032#section-8.4",
"url": "https://datatracker.ietf.org/doc/html/rfc8032#section-8.4"
},
{
"category": "external",
"summary": "https://github.com/digitalbazaar/forge/commit/bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85",
"url": "https://github.com/digitalbazaar/forge/commit/bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85"
},
{
"category": "external",
"summary": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rw",
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rw"
}
],
"release_date": "2026-03-27T20:47:54.492000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures"
},
{
"cve": "CVE-2026-33896",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-27T21:02:22.762233+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452458"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Forge (also known as node-forge), a JavaScript implementation of Transport Layer Security (TLS). The `pki.verifyCertificateChain()` function does not properly enforce certificate validation rules. This oversight allows an intermediate certificate that lacks specific security extensions to enable any leaf certificate to function as a Certificate Authority (CA) and sign other certificates. Consequently, node-forge could accept these unauthorized certificates as valid, potentially leading to spoofing or the issuance of illegitimate certificates.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33896"
},
{
"category": "external",
"summary": "RHBZ#2452458",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452458"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33896",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33896"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33896",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33896"
},
{
"category": "external",
"summary": "https://github.com/digitalbazaar/forge/commit/2e492832fb25227e6b647cbe1ac981c123171e90",
"url": "https://github.com/digitalbazaar/forge/commit/2e492832fb25227e6b647cbe1ac981c123171e90"
},
{
"category": "external",
"summary": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25",
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25"
}
],
"release_date": "2026-03-27T20:50:03.418000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance"
},
{
"cve": "CVE-2026-39983",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-04-09T18:02:16.209487+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456971"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in basic-ftp, an FTP client for Node.js. A remote attacker can exploit this vulnerability by injecting Carriage Return Line Feed (CRLF) sequences into file path parameters used by high-level APIs. This allows the attacker to split a single intended FTP command into multiple commands. Such command injection can lead to the execution of arbitrary commands, potentially compromising the integrity and availability of data or the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "basic-ftp: basic-ftp: Command injection via CRLF sequences in file path parameters",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39983"
},
{
"category": "external",
"summary": "RHBZ#2456971",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456971"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39983",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39983"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39983",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39983"
},
{
"category": "external",
"summary": "https://github.com/patrickjuchli/basic-ftp/commit/2ecc8e2c500c5234115f06fd1dbde1aa03d70f4b",
"url": "https://github.com/patrickjuchli/basic-ftp/commit/2ecc8e2c500c5234115f06fd1dbde1aa03d70f4b"
},
{
"category": "external",
"summary": "https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.1",
"url": "https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.1"
},
{
"category": "external",
"summary": "https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q",
"url": "https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q"
}
],
"release_date": "2026-04-09T17:05:46.228000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "basic-ftp: basic-ftp: Command injection via CRLF sequences in file path parameters"
},
{
"cve": "CVE-2026-40175",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-10T20:02:10.296601+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific \"Gadget\" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Axios library, a promise-based HTTP client, is susceptible to an Important prototype pollution vulnerability. This flaw, when combined with specific \"Gadget\" attack chains in third-party dependencies, can lead to remote code execution or full cloud compromise, including bypassing AWS IMDSv2.\n \nWith pollution check patch available in Axios gives an advantage, it remains vulnerable due to HTTP Header Sanitation and Server-Side Request Forgery threat.\n\nRed Hat products that incorporate the vulnerable Axios library are affected.\n\nThe openshift4/ose-monitoring-plugin-rhel9 container image is not vulnerable to this flaw. The affected component is used as a build-time dependency but it\u0027s not shipped in the final product, meaning the flaw is not present thus cannot be exploited in the container deployments.\n\nRegarding openshift4/ose-console for Product stream 4.12 and 4.13, the vulnerable component is present (indirect dependency), but the vulnerability is not exploitable in our case due to the browser runtime, where the required Node.js-specific attack vectors are not available. With this, the impact becomes low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"known_not_affected": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "RHBZ#2457432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40175"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1",
"url": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10660",
"url": "https://github.com/axios/axios/pull/10660"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx",
"url": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx"
}
],
"release_date": "2026-04-10T19:23:52.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T14:56:38+00:00",
"details": "For more about Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:b40f228ed49b81e675763d0bb1e38e7a45c45eef8003237abfbddbfb952bb331_amd64",
"Red Hat Developer Hub 1.8:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:f09d63af77eec6b131067a08b1bd3a8c7673f9e68325bfde1ae081f85d73598c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Remote Code Execution via Prototype Pollution escalation"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…