rhsa-2023_4003
Vulnerability from csaf_redhat
Published
2023-07-10 09:56
Modified
2024-12-10 17:54
Summary
Red Hat Security Advisory: Red Hat Service Interconnect 1.4 Release security update
Notes
Topic
This is release 1.4 of the rpms for Red Hat Service Interconnect. Red Hat Service Interconnect 1.4 introduces a service network, linking TCP and HTTP services across the hybrid cloud.
A service network enables communication between services running in different network locations or sites. It allows geographically distributed services to connect as if they were all running in the same site.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
As a Kubernetes user, I cannot connect easily connect services from one cluster with services on another cluster. Red Hat Application Interconnect enables me to create a service network and it allows geographically distributed services to connect as if they were all running in the same site.
Security Fix(es):
* golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)
* golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
* golang: crypto/elliptic: panic caused by oversized scalar (CVE-2022-28327)
* golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
* golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
* golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
* golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
* golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
* golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
* golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
* golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "This is release 1.4 of the rpms for Red Hat Service Interconnect. Red Hat Service Interconnect 1.4 introduces a service network, linking TCP and HTTP services across the hybrid cloud.\nA service network enables communication between services running in different network locations or sites. It allows geographically distributed services to connect as if they were all running in the same site.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "As a Kubernetes user, I cannot connect easily connect services from one cluster with services on another cluster. Red Hat Application Interconnect enables me to create a service network and it allows geographically distributed services to connect as if they were all running in the same site.\n\nSecurity Fix(es):\n\n* golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)\n\n* golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)\n\n* golang: crypto/elliptic: panic caused by oversized scalar (CVE-2022-28327)\n\n* golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)\n\n* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)\n\n* golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)\n\n* golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)\n\n* golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)\n\n* golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)\n\n* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)\n\n* golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)\n\n* golang: html/template: improper sanitization of CSS values (CVE-2023-24539)\n\n* golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2023:4003",
"url": "https://access.redhat.com/errata/RHSA-2023:4003"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_service_interconnect",
"url": "https://access.redhat.com/documentation/en-us/red_hat_service_interconnect"
},
{
"category": "external",
"summary": "2077689",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2077689"
},
{
"category": "external",
"summary": "2132867",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132867"
},
{
"category": "external",
"summary": "2132868",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132868"
},
{
"category": "external",
"summary": "2132872",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132872"
},
{
"category": "external",
"summary": "2178358",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178358"
},
{
"category": "external",
"summary": "2178488",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178488"
},
{
"category": "external",
"summary": "2178492",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178492"
},
{
"category": "external",
"summary": "2184481",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184481"
},
{
"category": "external",
"summary": "2184482",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184482"
},
{
"category": "external",
"summary": "2184483",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184483"
},
{
"category": "external",
"summary": "2184484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184484"
},
{
"category": "external",
"summary": "2196026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2196026"
},
{
"category": "external",
"summary": "2196029",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2196029"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4003.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Service Interconnect 1.4 Release security update",
"tracking": {
"current_release_date": "2024-12-10T17:54:19+00:00",
"generator": {
"date": "2024-12-10T17:54:19+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.3"
}
},
"id": "RHSA-2023:4003",
"initial_release_date": "2023-07-10T09:56:57+00:00",
"revision_history": [
{
"date": "2023-07-10T09:56:57+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2023-07-10T09:56:57+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-12-10T17:54:19+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Service Interconnect",
"product": {
"name": "Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:service_interconnect:1::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat Service Interconnect 1",
"product": {
"name": "Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:service_interconnect:1::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Service Interconnect"
},
{
"branches": [
{
"category": "product_version",
"name": "libwebsockets-0:4.3.1-1.el8ai.src",
"product": {
"name": "libwebsockets-0:4.3.1-1.el8ai.src",
"product_id": "libwebsockets-0:4.3.1-1.el8ai.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwebsockets@4.3.1-1.el8ai?arch=src"
}
}
},
{
"category": "product_version",
"name": "skupper-router-0:2.4.1-2.el8.src",
"product": {
"name": "skupper-router-0:2.4.1-2.el8.src",
"product_id": "skupper-router-0:2.4.1-2.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-router@2.4.1-2.el8?arch=src"
}
}
},
{
"category": "product_version",
"name": "qpid-proton-0:0.37.0-2.el8ai.src",
"product": {
"name": "qpid-proton-0:0.37.0-2.el8ai.src",
"product_id": "qpid-proton-0:0.37.0-2.el8ai.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qpid-proton@0.37.0-2.el8ai?arch=src"
}
}
},
{
"category": "product_version",
"name": "skupper-cli-0:1.4.1-2.el8.src",
"product": {
"name": "skupper-cli-0:1.4.1-2.el8.src",
"product_id": "skupper-cli-0:1.4.1-2.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-cli@1.4.1-2.el8?arch=src"
}
}
},
{
"category": "product_version",
"name": "libwebsockets-0:4.3.1-1.el9ai.src",
"product": {
"name": "libwebsockets-0:4.3.1-1.el9ai.src",
"product_id": "libwebsockets-0:4.3.1-1.el9ai.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwebsockets@4.3.1-1.el9ai?arch=src"
}
}
},
{
"category": "product_version",
"name": "skupper-router-0:2.4.1-2.el9.src",
"product": {
"name": "skupper-router-0:2.4.1-2.el9.src",
"product_id": "skupper-router-0:2.4.1-2.el9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-router@2.4.1-2.el9?arch=src"
}
}
},
{
"category": "product_version",
"name": "qpid-proton-0:0.37.0-2.el9ai.src",
"product": {
"name": "qpid-proton-0:0.37.0-2.el9ai.src",
"product_id": "qpid-proton-0:0.37.0-2.el9ai.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qpid-proton@0.37.0-2.el9ai?arch=src"
}
}
},
{
"category": "product_version",
"name": "jsoncpp-0:1.9.4-3.el9.src",
"product": {
"name": "jsoncpp-0:1.9.4-3.el9.src",
"product_id": "jsoncpp-0:1.9.4-3.el9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jsoncpp@1.9.4-3.el9?arch=src"
}
}
},
{
"category": "product_version",
"name": "skupper-cli-0:1.4.1-2.el9.src",
"product": {
"name": "skupper-cli-0:1.4.1-2.el9.src",
"product_id": "skupper-cli-0:1.4.1-2.el9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-cli@1.4.1-2.el9?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "libwebsockets-0:4.3.1-1.el8ai.x86_64",
"product": {
"name": "libwebsockets-0:4.3.1-1.el8ai.x86_64",
"product_id": "libwebsockets-0:4.3.1-1.el8ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwebsockets@4.3.1-1.el8ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"product": {
"name": "libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"product_id": "libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwebsockets-devel@4.3.1-1.el8ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"product": {
"name": "libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"product_id": "libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwebsockets-debugsource@4.3.1-1.el8ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"product": {
"name": "libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"product_id": "libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwebsockets-debuginfo@4.3.1-1.el8ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "skupper-router-0:2.4.1-2.el8.x86_64",
"product": {
"name": "skupper-router-0:2.4.1-2.el8.x86_64",
"product_id": "skupper-router-0:2.4.1-2.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-router@2.4.1-2.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"product": {
"name": "skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"product_id": "skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-router-debugsource@2.4.1-2.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"product": {
"name": "skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"product_id": "skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-router-debuginfo@2.4.1-2.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"product": {
"name": "python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"product_id": "python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-qpid-proton@0.37.0-2.el8ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"product": {
"name": "qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"product_id": "qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qpid-proton-c@0.37.0-2.el8ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"product": {
"name": "qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"product_id": "qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qpid-proton-c-devel@0.37.0-2.el8ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"product": {
"name": "qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"product_id": "qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qpid-proton-debugsource@0.37.0-2.el8ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"product": {
"name": "python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"product_id": "python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-qpid-proton-debuginfo@0.37.0-2.el8ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"product": {
"name": "qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"product_id": "qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qpid-proton-c-debuginfo@0.37.0-2.el8ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"product": {
"name": "qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"product_id": "qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qpid-proton-cpp-debuginfo@0.37.0-2.el8ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"product": {
"name": "qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"product_id": "qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qpid-proton-debuginfo@0.37.0-2.el8ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"product": {
"name": "rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"product_id": "rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-qpid_proton-debuginfo@0.37.0-2.el8ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "skupper-cli-0:1.4.1-2.el8.x86_64",
"product": {
"name": "skupper-cli-0:1.4.1-2.el8.x86_64",
"product_id": "skupper-cli-0:1.4.1-2.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-cli@1.4.1-2.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libwebsockets-0:4.3.1-1.el9ai.x86_64",
"product": {
"name": "libwebsockets-0:4.3.1-1.el9ai.x86_64",
"product_id": "libwebsockets-0:4.3.1-1.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwebsockets@4.3.1-1.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"product": {
"name": "libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"product_id": "libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwebsockets-devel@4.3.1-1.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"product": {
"name": "libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"product_id": "libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwebsockets-debugsource@4.3.1-1.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"product": {
"name": "libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"product_id": "libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libwebsockets-debuginfo@4.3.1-1.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "skupper-router-0:2.4.1-2.el9.x86_64",
"product": {
"name": "skupper-router-0:2.4.1-2.el9.x86_64",
"product_id": "skupper-router-0:2.4.1-2.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-router@2.4.1-2.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"product": {
"name": "skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"product_id": "skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-router-debugsource@2.4.1-2.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"product": {
"name": "skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"product_id": "skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-router-debuginfo@2.4.1-2.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"product": {
"name": "python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"product_id": "python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-qpid-proton@0.37.0-2.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"product": {
"name": "qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"product_id": "qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qpid-proton-c@0.37.0-2.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"product": {
"name": "qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"product_id": "qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qpid-proton-c-devel@0.37.0-2.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"product": {
"name": "qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"product_id": "qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qpid-proton-cpp@0.37.0-2.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"product": {
"name": "qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"product_id": "qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qpid-proton-cpp-devel@0.37.0-2.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"product": {
"name": "qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"product_id": "qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qpid-proton-debugsource@0.37.0-2.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"product": {
"name": "python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"product_id": "python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-qpid-proton-debuginfo@0.37.0-2.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"product": {
"name": "qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"product_id": "qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qpid-proton-c-debuginfo@0.37.0-2.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"product": {
"name": "qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"product_id": "qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qpid-proton-cpp-debuginfo@0.37.0-2.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"product": {
"name": "qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"product_id": "qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/qpid-proton-debuginfo@0.37.0-2.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"product": {
"name": "rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"product_id": "rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-qpid_proton-debuginfo@0.37.0-2.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jsoncpp-0:1.9.4-3.el9.x86_64",
"product": {
"name": "jsoncpp-0:1.9.4-3.el9.x86_64",
"product_id": "jsoncpp-0:1.9.4-3.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jsoncpp@1.9.4-3.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"product": {
"name": "jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"product_id": "jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jsoncpp-devel@1.9.4-3.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"product": {
"name": "jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"product_id": "jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jsoncpp-debugsource@1.9.4-3.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"product": {
"name": "jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"product_id": "jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jsoncpp-debuginfo@1.9.4-3.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "skupper-cli-0:1.4.1-2.el9.x86_64",
"product": {
"name": "skupper-cli-0:1.4.1-2.el9.x86_64",
"product_id": "skupper-cli-0:1.4.1-2.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-cli@1.4.1-2.el9?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "skupper-router-common-0:2.4.1-2.el8.noarch",
"product": {
"name": "skupper-router-common-0:2.4.1-2.el8.noarch",
"product_id": "skupper-router-common-0:2.4.1-2.el8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-router-common@2.4.1-2.el8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "skupper-router-docs-0:2.4.1-2.el8.noarch",
"product": {
"name": "skupper-router-docs-0:2.4.1-2.el8.noarch",
"product_id": "skupper-router-docs-0:2.4.1-2.el8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-router-docs@2.4.1-2.el8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "skupper-router-tools-0:2.4.1-2.el8.noarch",
"product": {
"name": "skupper-router-tools-0:2.4.1-2.el8.noarch",
"product_id": "skupper-router-tools-0:2.4.1-2.el8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-router-tools@2.4.1-2.el8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "skupper-router-common-0:2.4.1-2.el9.noarch",
"product": {
"name": "skupper-router-common-0:2.4.1-2.el9.noarch",
"product_id": "skupper-router-common-0:2.4.1-2.el9.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-router-common@2.4.1-2.el9?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "skupper-router-docs-0:2.4.1-2.el9.noarch",
"product": {
"name": "skupper-router-docs-0:2.4.1-2.el9.noarch",
"product_id": "skupper-router-docs-0:2.4.1-2.el9.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-router-docs@2.4.1-2.el9?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "skupper-router-tools-0:2.4.1-2.el9.noarch",
"product": {
"name": "skupper-router-tools-0:2.4.1-2.el9.noarch",
"product_id": "skupper-router-tools-0:2.4.1-2.el9.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skupper-router-tools@2.4.1-2.el9?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libwebsockets-0:4.3.1-1.el8ai.src as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src"
},
"product_reference": "libwebsockets-0:4.3.1-1.el8ai.src",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwebsockets-0:4.3.1-1.el8ai.x86_64 as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64"
},
"product_reference": "libwebsockets-0:4.3.1-1.el8ai.x86_64",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64 as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64"
},
"product_reference": "libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64 as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64"
},
"product_reference": "libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwebsockets-devel-0:4.3.1-1.el8ai.x86_64 as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64"
},
"product_reference": "libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-qpid-proton-0:0.37.0-2.el8ai.x86_64 as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64"
},
"product_reference": "python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64 as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64"
},
"product_reference": "python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qpid-proton-0:0.37.0-2.el8ai.src as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src"
},
"product_reference": "qpid-proton-0:0.37.0-2.el8ai.src",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qpid-proton-c-0:0.37.0-2.el8ai.x86_64 as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64"
},
"product_reference": "qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64 as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64"
},
"product_reference": "qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64 as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64"
},
"product_reference": "qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64 as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64"
},
"product_reference": "qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64 as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64"
},
"product_reference": "qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64 as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64"
},
"product_reference": "qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64 as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64"
},
"product_reference": "rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-cli-0:1.4.1-2.el8.src as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src"
},
"product_reference": "skupper-cli-0:1.4.1-2.el8.src",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-cli-0:1.4.1-2.el8.x86_64 as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64"
},
"product_reference": "skupper-cli-0:1.4.1-2.el8.x86_64",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-router-0:2.4.1-2.el8.src as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src"
},
"product_reference": "skupper-router-0:2.4.1-2.el8.src",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-router-0:2.4.1-2.el8.x86_64 as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64"
},
"product_reference": "skupper-router-0:2.4.1-2.el8.x86_64",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-router-common-0:2.4.1-2.el8.noarch as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch"
},
"product_reference": "skupper-router-common-0:2.4.1-2.el8.noarch",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-router-debuginfo-0:2.4.1-2.el8.x86_64 as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64"
},
"product_reference": "skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-router-debugsource-0:2.4.1-2.el8.x86_64 as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64"
},
"product_reference": "skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-router-docs-0:2.4.1-2.el8.noarch as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch"
},
"product_reference": "skupper-router-docs-0:2.4.1-2.el8.noarch",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-router-tools-0:2.4.1-2.el8.noarch as a component of Red Hat Service Interconnect",
"product_id": "8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch"
},
"product_reference": "skupper-router-tools-0:2.4.1-2.el8.noarch",
"relates_to_product_reference": "8Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jsoncpp-0:1.9.4-3.el9.src as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src"
},
"product_reference": "jsoncpp-0:1.9.4-3.el9.src",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jsoncpp-0:1.9.4-3.el9.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64"
},
"product_reference": "jsoncpp-0:1.9.4-3.el9.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64"
},
"product_reference": "jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jsoncpp-debugsource-0:1.9.4-3.el9.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64"
},
"product_reference": "jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jsoncpp-devel-0:1.9.4-3.el9.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64"
},
"product_reference": "jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwebsockets-0:4.3.1-1.el9ai.src as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src"
},
"product_reference": "libwebsockets-0:4.3.1-1.el9ai.src",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwebsockets-0:4.3.1-1.el9ai.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64"
},
"product_reference": "libwebsockets-0:4.3.1-1.el9ai.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64"
},
"product_reference": "libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64"
},
"product_reference": "libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwebsockets-devel-0:4.3.1-1.el9ai.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64"
},
"product_reference": "libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-qpid-proton-0:0.37.0-2.el9ai.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64"
},
"product_reference": "python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64"
},
"product_reference": "python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qpid-proton-0:0.37.0-2.el9ai.src as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src"
},
"product_reference": "qpid-proton-0:0.37.0-2.el9ai.src",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qpid-proton-c-0:0.37.0-2.el9ai.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64"
},
"product_reference": "qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64"
},
"product_reference": "qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64"
},
"product_reference": "qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64"
},
"product_reference": "qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64"
},
"product_reference": "qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64"
},
"product_reference": "qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64"
},
"product_reference": "qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64"
},
"product_reference": "qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64"
},
"product_reference": "rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-cli-0:1.4.1-2.el9.src as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src"
},
"product_reference": "skupper-cli-0:1.4.1-2.el9.src",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-cli-0:1.4.1-2.el9.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
},
"product_reference": "skupper-cli-0:1.4.1-2.el9.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-router-0:2.4.1-2.el9.src as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src"
},
"product_reference": "skupper-router-0:2.4.1-2.el9.src",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-router-0:2.4.1-2.el9.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64"
},
"product_reference": "skupper-router-0:2.4.1-2.el9.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-router-common-0:2.4.1-2.el9.noarch as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch"
},
"product_reference": "skupper-router-common-0:2.4.1-2.el9.noarch",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-router-debuginfo-0:2.4.1-2.el9.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64"
},
"product_reference": "skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-router-debugsource-0:2.4.1-2.el9.x86_64 as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64"
},
"product_reference": "skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-router-docs-0:2.4.1-2.el9.noarch as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch"
},
"product_reference": "skupper-router-docs-0:2.4.1-2.el9.noarch",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skupper-router-tools-0:2.4.1-2.el9.noarch as a component of Red Hat Service Interconnect 1",
"product_id": "9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
},
"product_reference": "skupper-router-tools-0:2.4.1-2.el9.noarch",
"relates_to_product_reference": "9Base-Service-Interconnect-1"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Adam Korczynski"
],
"organization": "ADA Logics"
},
{
"names": [
"OSS-Fuzz"
]
}
],
"cve": "CVE-2022-2879",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2022-10-07T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2132867"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the golang package, where Reader.Read does not set a limit on the maximum size of file headers. After fixing, Reader.Read limits the maximum size of header blocks to 1 MiB. This flaw allows a maliciously crafted archive to cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: archive/tar: unbounded memory consumption when reading headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The opportunity for a Denial of Service is limited to the golang runtime. In the case of OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"known_not_affected": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-2879"
},
{
"category": "external",
"summary": "RHBZ#2132867",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132867"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-2879",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2879"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2879",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2879"
},
{
"category": "external",
"summary": "https://github.com/golang/go/issues/54853",
"url": "https://github.com/golang/go/issues/54853"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1",
"url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1"
}
],
"release_date": "2022-10-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-07-10T09:56:57+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:4003"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: archive/tar: unbounded memory consumption when reading headers"
},
{
"acknowledgments": [
{
"names": [
"Daniel Abeles"
],
"organization": "Head of Research, Oxeye"
},
{
"names": [
"Gal Goldstein"
],
"organization": "Security Researcher, Oxeye"
}
],
"cve": "CVE-2022-2880",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2022-10-07T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2132868"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the golang package, where requests forwarded by reverse proxy include the raw query parameters from the inbound request, including unparseable parameters rejected by net/http. This issue could permit query parameter smuggling when a Go proxy forwards a parameter with an unparseable value. After the fix, the reverse proxy sanitizes the query parameters in the forwarded query when the outbound request\u0027s form field is set after the reverse proxy. The director function returns, indicating that the proxy has parsed the query parameters. Proxies that do not parse query parameters continue to forward the original query parameters unchanged.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The opportunity to exploit this vulnerability is limited to the Golang runtime. In the case of the OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"known_not_affected": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-2880"
},
{
"category": "external",
"summary": "RHBZ#2132868",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132868"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-2880",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2880"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2880",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2880"
},
{
"category": "external",
"summary": "https://github.com/golang/go/issues/54663",
"url": "https://github.com/golang/go/issues/54663"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1",
"url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1"
}
],
"release_date": "2022-10-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-07-10T09:56:57+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:4003"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters"
},
{
"cve": "CVE-2022-28327",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2022-04-21T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2077689"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow flaw was found in Golang\u0027s crypto/elliptic library. This flaw allows an attacker to use a crafted scaler input longer than 32 bytes, causing P256().ScalarMult or P256().ScalarBaseMult to panic, leading to a loss of availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: crypto/elliptic: panic caused by oversized scalar",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux 7, 8 and 9 are affected, because the code-base is affected by this vulnerability.\n\nRed Hat Product Security has rated this issue as having Moderate security impact, and the issue is not currently planned to be addressed in future updates for Red Hat Enterprise Linux 7, hence, marked as Out-of-Support-Scope. \n\nRed Hat Developer Tools - Compilers (go-toolset-1.16-golang \u0026 go-toolset-1.17-golang), ships the vulnerable code and affected by this vulnerability.\n\nFor additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/ and Red Hat Enterprise Linux Life Cycle \u0026 Updates Policy: https://access.redhat.com/support/policy/updates/errata/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"known_not_affected": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-28327"
},
{
"category": "external",
"summary": "RHBZ#2077689",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2077689"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-28327",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28327"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-28327",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28327"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/oecdBNLOml8",
"url": "https://groups.google.com/g/golang-announce/c/oecdBNLOml8"
}
],
"release_date": "2022-04-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-07-10T09:56:57+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:4003"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: crypto/elliptic: panic caused by oversized scalar"
},
{
"acknowledgments": [
{
"names": [
"Adam Korczynski"
],
"organization": "ADA Logics"
},
{
"names": [
"OSS-Fuzz"
]
}
],
"cve": "CVE-2022-41715",
"discovery_date": "2022-10-07T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2132872"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the golang package, where programs that compile regular expressions from untrusted sources are vulnerable to memory exhaustion or a denial of service. The parsed regexp representation is linear in the input size. Still, in some cases, the constant factor can be as high as 40,000, making a relatively small regexp consume larger amounts of memory. After the fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Routine use of regular expressions is unaffected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: regexp/syntax: limit memory used by parsing regexps",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The opportunity for a Denial of Service is limited to the golang runtime. In the case of OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
],
"known_not_affected": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-41715"
},
{
"category": "external",
"summary": "RHBZ#2132872",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132872"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-41715",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41715"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41715",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41715"
},
{
"category": "external",
"summary": "https://github.com/golang/go/issues/55949",
"url": "https://github.com/golang/go/issues/55949"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1",
"url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1"
}
],
"release_date": "2022-10-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-07-10T09:56:57+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:4003"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: regexp/syntax: limit memory used by parsing regexps"
},
{
"acknowledgments": [
{
"names": [
"Philippe Antoine"
],
"organization": "Catena Cyber"
}
],
"cve": "CVE-2022-41723",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2023-03-14T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2178358"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Within OpenShift Container Platform, the maximum impact of this vulnerability is a denial of service against an individual container so the impact could not cascade across the entire infrastructure, this vulnerability is rated Moderate impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"known_not_affected": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-41723"
},
{
"category": "external",
"summary": "RHBZ#2178358",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178358"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-41723",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41723"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41723",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41723"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-vvpx-j8f3-3w6h",
"url": "https://github.com/advisories/GHSA-vvpx-j8f3-3w6h"
},
{
"category": "external",
"summary": "https://go.dev/cl/468135",
"url": "https://go.dev/cl/468135"
},
{
"category": "external",
"summary": "https://go.dev/cl/468295",
"url": "https://go.dev/cl/468295"
},
{
"category": "external",
"summary": "https://go.dev/issue/57855",
"url": "https://go.dev/issue/57855"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E",
"url": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2023-1571",
"url": "https://pkg.go.dev/vuln/GO-2023-1571"
},
{
"category": "external",
"summary": "https://vuln.go.dev/ID/GO-2023-1571.json",
"url": "https://vuln.go.dev/ID/GO-2023-1571.json"
}
],
"release_date": "2023-02-17T14:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-07-10T09:56:57+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:4003"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding"
},
{
"cve": "CVE-2022-41724",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2023-03-15T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2178492"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Golang Go, where it is vulnerable to a denial of service caused when processing large TLS handshake records. By sending specially-crafted TLS handshake records, a remote, authenticated attacker can cause a denial of service condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: crypto/tls: large handshake records may cause panics",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The opportunity for a denial of service is limited to the golang runtime. In the case of the OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"known_not_affected": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-41724"
},
{
"category": "external",
"summary": "RHBZ#2178492",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178492"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-41724",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41724"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41724",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41724"
},
{
"category": "external",
"summary": "https://go.dev/cl/468125",
"url": "https://go.dev/cl/468125"
},
{
"category": "external",
"summary": "https://go.dev/issue/58001",
"url": "https://go.dev/issue/58001"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E",
"url": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2023-1570",
"url": "https://pkg.go.dev/vuln/GO-2023-1570"
}
],
"release_date": "2023-02-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-07-10T09:56:57+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:4003"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: crypto/tls: large handshake records may cause panics"
},
{
"cve": "CVE-2022-41725",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2023-03-15T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2178488"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go, where it is vulnerable to a denial of service caused by an excessive resource consumption flaw in the net/http and mime/multipart packages. By sending a specially-crafted request, a remote attacker can cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http, mime/multipart: denial of service from excessive resource consumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The opportunity for a Denial of Service is limited to the golang runtime. In the case of the OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"known_not_affected": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-41725"
},
{
"category": "external",
"summary": "RHBZ#2178488",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178488"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-41725",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41725"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41725",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41725"
},
{
"category": "external",
"summary": "https://go.dev/cl/468124",
"url": "https://go.dev/cl/468124"
},
{
"category": "external",
"summary": "https://go.dev/issue/58006",
"url": "https://go.dev/issue/58006"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E",
"url": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2023-1569",
"url": "https://pkg.go.dev/vuln/GO-2023-1569"
}
],
"release_date": "2023-02-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-07-10T09:56:57+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:4003"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/http, mime/multipart: denial of service from excessive resource consumption"
},
{
"cve": "CVE-2023-24534",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2023-04-04T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2184483"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by memory exhaustion in the common function in HTTP and MIME header parsing. By sending a specially crafted request, a remote attacker can cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http, net/textproto: denial of service from excessive memory allocation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"known_not_affected": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-24534"
},
{
"category": "external",
"summary": "RHBZ#2184483",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184483"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-24534",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24534"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24534",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24534"
},
{
"category": "external",
"summary": "https://go.dev/issue/58975",
"url": "https://go.dev/issue/58975"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8",
"url": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8"
}
],
"release_date": "2023-04-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-07-10T09:56:57+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:4003"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/http, net/textproto: denial of service from excessive memory allocation"
},
{
"cve": "CVE-2023-24536",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2023-04-04T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2184482"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by an issue during multipart form parsing. By sending a specially crafted input, a remote attacker can consume large amounts of CPU and memory, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "For Red Hat Enterprise Linux,\n\n* Conmon uses Go in unit testing, but not functionally in the package. Go is used only in test files, hence, not in the actual code, thus, conmon is not-affected.\n* The CVE refers to multipart form parsing routine mime/multipart.Reader.ReadForm, which is not used in Grafana, hence it is not-affected.\n* Butane does not parse multipart forms, hence, it is also not-affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"known_not_affected": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-24536"
},
{
"category": "external",
"summary": "RHBZ#2184482",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184482"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-24536",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24536"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24536",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24536"
},
{
"category": "external",
"summary": "https://go.dev/issue/59153",
"url": "https://go.dev/issue/59153"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8",
"url": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8"
}
],
"release_date": "2023-04-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-07-10T09:56:57+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:4003"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption"
},
{
"cve": "CVE-2023-24537",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2023-04-04T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2184484"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by an infinite loop due to integer overflow when calling any of the Parse functions. By sending a specially crafted input, a remote attacker can cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: go/parser: Infinite loop in parsing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"known_not_affected": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-24537"
},
{
"category": "external",
"summary": "RHBZ#2184484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184484"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-24537",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24537"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24537",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24537"
},
{
"category": "external",
"summary": "https://github.com/golang/go/issues/59180",
"url": "https://github.com/golang/go/issues/59180"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8",
"url": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8"
}
],
"release_date": "2023-04-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-07-10T09:56:57+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:4003"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: go/parser: Infinite loop in parsing"
},
{
"cve": "CVE-2023-24538",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2023-04-04T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2184481"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Golang Go. This flaw allows a remote attacker to execute arbitrary code on the system, caused by not properly considering backticks (`) as Javascript string delimiters. By sending a specially crafted request, an attacker execute arbitrary code on the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: html/template: backticks not treated as string delimiters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The described issue involving Go templates and JavaScript template literals poses a moderate severity rather than an important one due to several mitigating factors. Firstly, the vulnerability requires specific conditions to be met: the presence of Go templates within JavaScript template literals. This limits the scope of affected codebases, reducing the likelihood of exploitation. Additionally, the decision to disallow such interactions in future releases of Go indicates a proactive approach to addressing the issue. Furthermore, the affected packages or components within Red Hat Enterprise Linux, such as Conmon, Grafana, and the RHC package, have been assessed and determined not to be impacted due to their specific usage patterns. So the limited scope of affected systems and the absence of exploitation vectors in specific components within Red Hat Enterprise Linux contribute to categorizing the severity of the issue as moderate.\n\nFor Red Hat Enterprise Linux,\n\n* Conmon uses go in unit testing, but not functionally in the package. Go is used only in test files, hence, not in the actual code, thus, conmon is not affected.\n* The Go templates in Grafana do not contain any javascript. Thus, it is not affected.\n* The rhc package do not make use of html/template. Hence, it is also not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"known_not_affected": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-24538"
},
{
"category": "external",
"summary": "RHBZ#2184481",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184481"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-24538",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24538"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24538",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24538"
},
{
"category": "external",
"summary": "https://github.com/golang/go/issues/59234",
"url": "https://github.com/golang/go/issues/59234"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8",
"url": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8"
}
],
"release_date": "2023-04-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-07-10T09:56:57+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:4003"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: html/template: backticks not treated as string delimiters"
},
{
"acknowledgments": [
{
"names": [
"Juho Nurminen"
],
"organization": "Mattermost"
}
],
"cve": "CVE-2023-24539",
"cwe": {
"id": "CWE-176",
"name": "Improper Handling of Unicode Encoding"
},
"discovery_date": "2023-05-07T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2196026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang where angle brackets (\u003c\u003e) were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a \u0027/\u0027 character could result in the CSS context unexpectedly closing, allowing for the injection of unexpected HMTL if executed with untrusted input.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: html/template: improper sanitization of CSS values",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "For Red Hat Enterprise Linux,\n\n* Conmon uses go in unit testing, but not functionally in the package. Go is used only in test files, not in the actual code. Thus, conmon is not affected.\n* The Go templates in Grafana do not contain any javascript. Thus, it is not affected.\n* Ignition does not make use of html/template.\n\nIn Red Hat Advanced Cluster Management for Kubernetes (RHACM), the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable golang html/templates to authenticated users only, therefore, the impact is low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"known_not_affected": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-24539"
},
{
"category": "external",
"summary": "RHBZ#2196026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2196026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-24539",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24539"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24539",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24539"
},
{
"category": "external",
"summary": "https://github.com/golang/go/issues/59720",
"url": "https://github.com/golang/go/issues/59720"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU",
"url": "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU"
}
],
"release_date": "2023-04-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-07-10T09:56:57+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:4003"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: html/template: improper sanitization of CSS values"
},
{
"acknowledgments": [
{
"names": [
"Juho Nurminen"
],
"organization": "Mattermost"
}
],
"cve": "CVE-2023-29400",
"cwe": {
"id": "CWE-176",
"name": "Improper Handling of Unicode Encoding"
},
"discovery_date": "2023-05-07T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2196029"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang. Templates containing actions in unquoted HTML attributes, for example, \"attr={{.}}\") executed with empty input, could result in output that has unexpected results when parsed due to HTML normalization rules. This issue may allow the injection of arbitrary attributes into tags.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: html/template: improper handling of empty HTML attributes",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "For Red Hat Enterprise Linux,\n\n* Conmon uses go in unit testing, but not functionally in the package. Go is used only in test files, not in the actual code. Thus, conmon is not affected.\n* The Go templates in Grafana do not contain any javascript. Thus, it is not affected.\n* Ignition does not make use of html/template.\n\nIn OpenShift Container Platform and Red Hat Advanced Cluster Management for Kubernetes (RHACM), the affected containers are behind OAuth authentication. This restricts access to the vulnerable golang html/templates to authenticated users, reducing the impact to low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"known_not_affected": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-29400"
},
{
"category": "external",
"summary": "RHBZ#2196029",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2196029"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-29400",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29400"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-29400",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29400"
},
{
"category": "external",
"summary": "https://go.dev/issue/59722",
"url": "https://go.dev/issue/59722"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU",
"url": "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU"
}
],
"release_date": "2023-04-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-07-10T09:56:57+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:4003"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.src",
"8Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el8ai.src",
"8Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el8ai.x86_64",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.src",
"8Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el8.x86_64",
"8Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el8.noarch",
"8Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el8.noarch",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.src",
"9Base-Service-Interconnect-1:jsoncpp-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debuginfo-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-debugsource-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:jsoncpp-devel-0:1.9.4-3.el9.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.src",
"9Base-Service-Interconnect-1:libwebsockets-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debuginfo-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-debugsource-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:libwebsockets-devel-0:4.3.1-1.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:python3-qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-0:0.37.0-2.el9ai.src",
"9Base-Service-Interconnect-1:qpid-proton-c-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-c-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-cpp-devel-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:qpid-proton-debugsource-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:rubygem-qpid_proton-debuginfo-0:0.37.0-2.el9ai.x86_64",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-cli-0:1.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.src",
"9Base-Service-Interconnect-1:skupper-router-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-common-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-debuginfo-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-debugsource-0:2.4.1-2.el9.x86_64",
"9Base-Service-Interconnect-1:skupper-router-docs-0:2.4.1-2.el9.noarch",
"9Base-Service-Interconnect-1:skupper-router-tools-0:2.4.1-2.el9.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: html/template: improper handling of empty HTML attributes"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.