{
  "affected": [
    {
      "affectedData": [
        {
          "product": "urllib3",
          "vendor": "urllib3",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "45C2B2EF-1774-47F0-9480-F5CE26947B78",
              "versionEndExcluding": "2.5.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0."
    },
    {
      "lang": "es",
      "value": "urllib3 es una librer\u00eda cliente HTTP intuitiva para Python. Antes de la versi\u00f3n 2.5.0, era posible deshabilitar las redirecciones para todas las solicitudes instanciando un PoolManager y especificando reintentos para deshabilitarlas. Por defecto, las solicitudes y los usuarios de botocore no se ven afectados. Una aplicaci\u00f3n que intente mitigar vulnerabilidades de SSRF o de redirecci\u00f3n abierta deshabilitando las redirecciones a nivel de PoolManager seguir\u00e1 siendo vulnerable. Este problema se ha corregido en la versi\u00f3n 2.5.0."
    }
  ],
  "id": "CVE-2025-50181",
  "lastModified": "2026-06-17T09:34:48.843",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-50181",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-06-23T16:45:50.408081Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-06-19T01:15:24.453",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/urllib3/urllib3/releases/tag/2.5.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "urllib3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-50181"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-18T17:50:00Z",
    "nvd_published_at": "2025-06-19T01:15:24Z",
    "severity": "MODERATE"
  },
  "details": "urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows:\n\n```python\nresp = urllib3.request(\"GET\", \"https://httpbin.org/redirect/1\", redirect=False)\nprint(resp.status)\n# 302\n```\n\nHowever, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects:\n\n```python\nimport urllib3\n\nhttp = urllib3.PoolManager(retries=0)  # should raise MaxRetryError on redirect\nhttp = urllib3.PoolManager(retries=urllib3.Retry(redirect=0))  # equivalent to the above\nhttp = urllib3.PoolManager(retries=False)  # should return the first response\n\nresp = http.request(\"GET\", \"https://httpbin.org/redirect/1\")\n```\n\nHowever, the `retries` parameter is currently ignored, which means all the above examples don\u0027t disable redirects.\n\n## Affected usages\n\nPassing `retries` on `PoolManager` instantiation to disable redirects or restrict their number.\n\nBy default, requests and botocore users are not affected.\n\n## Impact\n\nRedirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.\n\n## Remediation\n\nYou can remediate this vulnerability with the following steps:\n\n * Upgrade to a patched version of urllib3. If your organization would benefit from the continued support of urllib3 1.x, please contact [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com) to discuss sponsorship or contribution opportunities.\n * Disable redirects at the `request()` level instead of the `PoolManager()` level.",
  "id": "GHSA-pq67-6m6q-mj2v",
  "modified": "2025-12-22T21:33:21Z",
  "published": "2025-06-18T17:50:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50181"
    },
    {
      "type": "WEB",
      "url": "https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/urllib3/urllib3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/urllib3/urllib3/releases/tag/2.5.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation"
}

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2025-50181 urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-50181.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation",
    "tracking": {
      "current_release_date": "2026-02-18T02:26:12.000Z",
      "generator": {
        "date": "2026-02-18T13:34:41.677Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2025-50181",
      "initial_release_date": "2025-06-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-07-18T00:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2025-08-07T00:00:00.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Added python-urllib3 to Azure Linux 3.0\nAdded python3 to CBL-Mariner 2.0"
        },
        {
          "date": "2026-02-18T02:26:12.000Z",
          "legacy_version": "2.1",
          "number": "3",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              },
              {
                "category": "product_version",
                "name": "2.0",
                "product": {
                  "name": "CBL Mariner 2.0",
                  "product_id": "17086"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 python-urllib3 2.0.7-2",
                "product": {
                  "name": "\u003cazl3 python-urllib3 2.0.7-2",
                  "product_id": "9"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 python-urllib3 2.0.7-2",
                "product": {
                  "name": "azl3 python-urllib3 2.0.7-2",
                  "product_id": "19620"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 python-urllib3 1.26.19-2",
                "product": {
                  "name": "\u003ccbl2 python-urllib3 1.26.19-2",
                  "product_id": "4"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 python-urllib3 1.26.19-2",
                "product": {
                  "name": "cbl2 python-urllib3 1.26.19-2",
                  "product_id": "20389"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 python-urllib3 1.26.19-1",
                "product": {
                  "name": "\u003ccbl2 python-urllib3 1.26.19-1",
                  "product_id": "5"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 python-urllib3 1.26.19-1",
                "product": {
                  "name": "cbl2 python-urllib3 1.26.19-1",
                  "product_id": "20346"
                }
              }
            ],
            "category": "product_name",
            "name": "python-urllib3"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 python-virtualenv 20.26.6-1",
                "product": {
                  "name": "\u003ccbl2 python-virtualenv 20.26.6-1",
                  "product_id": "7"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 python-virtualenv 20.26.6-1",
                "product": {
                  "name": "cbl2 python-virtualenv 20.26.6-1",
                  "product_id": "19849"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 python-virtualenv 20.26.6-2",
                "product": {
                  "name": "\u003ccbl2 python-virtualenv 20.26.6-2",
                  "product_id": "3"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 python-virtualenv 20.26.6-2",
                "product": {
                  "name": "cbl2 python-virtualenv 20.26.6-2",
                  "product_id": "20530"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 python-virtualenv 20.26.6-1",
                "product": {
                  "name": "\u003ccbl2 python-virtualenv 20.26.6-1",
                  "product_id": "12"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 python-virtualenv 20.26.6-1",
                "product": {
                  "name": "cbl2 python-virtualenv 20.26.6-1",
                  "product_id": "17171"
                }
              }
            ],
            "category": "product_name",
            "name": "python-virtualenv"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 python-pip 24.2-4",
                "product": {
                  "name": "\u003cazl3 python-pip 24.2-4",
                  "product_id": "2"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 python-pip 24.2-4",
                "product": {
                  "name": "azl3 python-pip 24.2-4",
                  "product_id": "20561"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 python-pip 24.2-5",
                "product": {
                  "name": "\u003cazl3 python-pip 24.2-5",
                  "product_id": "1"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 python-pip 24.2-5",
                "product": {
                  "name": "azl3 python-pip 24.2-5",
                  "product_id": "20617"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 python-pip 24.2-3",
                "product": {
                  "name": "\u003cazl3 python-pip 24.2-3",
                  "product_id": "6"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 python-pip 24.2-3",
                "product": {
                  "name": "azl3 python-pip 24.2-3",
                  "product_id": "20043"
                }
              }
            ],
            "category": "product_name",
            "name": "python-pip"
          },
          {
            "category": "product_name",
            "name": "azl3 tensorflow 2.16.1-9",
            "product": {
              "name": "azl3 tensorflow 2.16.1-9",
              "product_id": "10"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 python3 3.9.19-13",
            "product": {
              "name": "cbl2 python3 3.9.19-13",
              "product_id": "8"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 python3 3.9.19-13",
            "product": {
              "name": "cbl2 python3 3.9.19-13",
              "product_id": "8"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 python3 3.12.9-1",
            "product": {
              "name": "azl3 python3 3.12.9-1",
              "product_id": "11"
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 python-urllib3 2.0.7-2 as a component of Azure Linux 3.0",
          "product_id": "17084-9"
        },
        "product_reference": "9",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 python-urllib3 2.0.7-2 as a component of Azure Linux 3.0",
          "product_id": "19620-17084"
        },
        "product_reference": "19620",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 python-virtualenv 20.26.6-1 as a component of CBL Mariner 2.0",
          "product_id": "17086-7"
        },
        "product_reference": "7",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 python-virtualenv 20.26.6-1 as a component of CBL Mariner 2.0",
          "product_id": "19849-17086"
        },
        "product_reference": "19849",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 tensorflow 2.16.1-9 as a component of Azure Linux 3.0",
          "product_id": "17084-10"
        },
        "product_reference": "10",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 python-urllib3 1.26.19-2 as a component of CBL Mariner 2.0",
          "product_id": "17086-4"
        },
        "product_reference": "4",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 python-urllib3 1.26.19-2 as a component of CBL Mariner 2.0",
          "product_id": "20389-17086"
        },
        "product_reference": "20389",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 python-virtualenv 20.26.6-2 as a component of CBL Mariner 2.0",
          "product_id": "17086-3"
        },
        "product_reference": "3",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 python-virtualenv 20.26.6-2 as a component of CBL Mariner 2.0",
          "product_id": "20530-17086"
        },
        "product_reference": "20530",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 python-pip 24.2-4 as a component of Azure Linux 3.0",
          "product_id": "17084-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 python-pip 24.2-4 as a component of Azure Linux 3.0",
          "product_id": "20561-17084"
        },
        "product_reference": "20561",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 python-pip 24.2-5 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 python-pip 24.2-5 as a component of Azure Linux 3.0",
          "product_id": "20617-17084"
        },
        "product_reference": "20617",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 python-urllib3 1.26.19-1 as a component of CBL Mariner 2.0",
          "product_id": "17086-5"
        },
        "product_reference": "5",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 python-urllib3 1.26.19-1 as a component of CBL Mariner 2.0",
          "product_id": "20346-17086"
        },
        "product_reference": "20346",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 python3 3.9.19-13 as a component of CBL Mariner 2.0",
          "product_id": "17086-8"
        },
        "product_reference": "8",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 python-pip 24.2-3 as a component of Azure Linux 3.0",
          "product_id": "17084-6"
        },
        "product_reference": "6",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 python-pip 24.2-3 as a component of Azure Linux 3.0",
          "product_id": "20043-17084"
        },
        "product_reference": "20043",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 python3 3.12.9-1 as a component of Azure Linux 3.0",
          "product_id": "17084-11"
        },
        "product_reference": "11",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 python-virtualenv 20.26.6-1 as a component of CBL Mariner 2.0",
          "product_id": "17086-12"
        },
        "product_reference": "12",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 python-virtualenv 20.26.6-1 as a component of CBL Mariner 2.0",
          "product_id": "17171-17086"
        },
        "product_reference": "17171",
        "relates_to_product_reference": "17086"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-50181",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0026#39;Open Redirect\u0026#39;)"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "17084-10",
            "17086-8",
            "17084-11"
          ]
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GitHub_M",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "19620-17084",
          "19849-17086",
          "20389-17086",
          "20530-17086",
          "20561-17084",
          "20617-17084",
          "20346-17086",
          "20043-17084",
          "17171-17086"
        ],
        "known_affected": [
          "17084-9",
          "17086-7",
          "17086-4",
          "17086-3",
          "17084-2",
          "17084-1",
          "17086-5",
          "17084-6",
          "17086-12"
        ],
        "known_not_affected": [
          "17084-10",
          "17086-8",
          "17084-11"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-50181 urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-50181.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-18T00:00:00.000Z",
          "details": "2.0.7-2:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-9"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2025-07-18T00:00:00.000Z",
          "details": "20.26.6-2:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-7",
            "17086-3",
            "17086-12"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2025-07-18T00:00:00.000Z",
          "details": "1.26.19-2:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-4",
            "17086-5"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2025-07-18T00:00:00.000Z",
          "details": "24.2-3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-2",
            "17084-6"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2025-07-18T00:00:00.000Z",
          "details": "24.2-5:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-1"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 5.3,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "17084-9",
            "17086-7",
            "17086-4",
            "17086-3",
            "17084-2",
            "17084-1",
            "17086-5",
            "17084-6",
            "17086-12"
          ]
        }
      ],
      "title": "urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Oracle heeft kwetsbaarheden verholpen in Oracle PeopleSoft (Specifiek voor versies 8.60, 8.61, 8.62 en 9.2).",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden in Oracle PeopleSoft stellen aanvallers in staat om ongeautoriseerde toegang te verkrijgen tot gevoelige gegevens en kunnen leiden tot gegevensmanipulatie. Dit omvat kwetsbaarheden die het mogelijk maken voor zowel laag- als hooggeprivilegieerde aanvallers om via HTTP toegang te krijgen tot kritieke data, met een CVSS-score vari\u00ebrend van 4.3 tot 7.5, wat wijst op aanzienlijke risico\u0027s voor de vertrouwelijkheid en integriteit van de gegevens. De kwetsbaarheden zijn te vinden in verschillende componenten zoals OpenSearch Dashboards, PeopleTools, en IT Asset Management.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Input Validation",
        "title": "CWE-20"
      },
      {
        "category": "general",
        "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
        "title": "CWE-22"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
        "title": "CWE-79"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Read",
        "title": "CWE-125"
      },
      {
        "category": "general",
        "text": "Exposure of Sensitive Information to an Unauthorized Actor",
        "title": "CWE-200"
      },
      {
        "category": "general",
        "text": "Improper Access Control",
        "title": "CWE-284"
      },
      {
        "category": "general",
        "text": "Improper Certificate Validation",
        "title": "CWE-295"
      },
      {
        "category": "general",
        "text": "Uncontrolled Resource Consumption",
        "title": "CWE-400"
      },
      {
        "category": "general",
        "text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
        "title": "CWE-601"
      },
      {
        "category": "general",
        "text": "Uncontrolled Recursion",
        "title": "CWE-674"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.oracle.com/security-alerts/cpuoct2025.html"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Oracle PeopleSoft",
    "tracking": {
      "current_release_date": "2025-10-23T14:13:39.969386Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2025-0340",
      "initial_release_date": "2025-10-23T14:13:39.969386Z",
      "revision_history": [
        {
          "date": "2025-10-23T14:13:39.969386Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft Enterprise CS Financial Aid"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-3"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft Enterprise FIN IT Asset Management"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-4"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft Enterprise FIN Maintenance Management"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-5"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft Enterprise FIN Payables"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-6"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft Enterprise PeopleTools"
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-54160",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Oracle PeopleSoft\u0027s OpenSearch Dashboards (version 8.62) has a vulnerability allowing low-privileged attackers to exploit the system via HTTP, while earlier OpenSearch versions are vulnerable to XSS attacks due to unsanitized Markdown.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54160 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-54160.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2024-54160"
    },
    {
      "cve": "CVE-2025-4517",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        },
        {
          "category": "description",
          "text": "Recent updates to Python versions 3.6 through 3.13.5 address multiple security vulnerabilities, particularly in the tarfile module, while enhancing various functionalities and resolving issues related to memory management and IPv6 handling.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-4517 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-4517.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2025-4517"
    },
    {
      "cve": "CVE-2025-4575",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Certificate Validation",
          "title": "CWE-295"
        },
        {
          "category": "description",
          "text": "OpenSSL 3.5 has a critical bug in the -addreject option that mislabels trusted certificates, while also being vulnerable to unauthorized data modification, alongside a separate vulnerability in Oracle Communications Cloud Native Core Certificate Management 25.1.200.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-4575 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-4575.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2025-4575"
    },
    {
      "cve": "CVE-2025-31672",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Input Validation",
          "title": "CWE-20"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities have been identified across various products, including Apache POI, Oracle BPM Suite, JD Edwards EnterpriseOne, and SAP BusinessObjects, affecting data integrity and allowing unauthorized access or manipulation.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-31672 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-31672.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2025-31672"
    },
    {
      "cve": "CVE-2025-48734",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Access Control",
          "title": "CWE-284"
        },
        {
          "category": "description",
          "text": "Recent updates to Apache Commons BeanUtils address multiple vulnerabilities, including arbitrary code execution risks and unauthorized access to Java enum properties, affecting versions prior to 1.11.0 and 2.0.0-M2.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-48734 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48734.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2025-48734"
    },
    {
      "cve": "CVE-2025-48924",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Recursion",
          "title": "CWE-674"
        },
        {
          "category": "description",
          "text": "Recent vulnerabilities in Oracle WebLogic Server and Apache Commons Lang versions expose systems to denial of service risks, including an uncontrolled recursion flaw leading to StackOverflowErrors.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-48924 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48924.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2025-48924"
    },
    {
      "cve": "CVE-2025-50181",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
          "title": "CWE-601"
        },
        {
          "category": "description",
          "text": "Recent vulnerabilities in urllib3 and Oracle PeopleSoft\u0027s PeopleTools expose systems to SSRF attacks and unauthorized data access, with specific issues related to redirect handling and low-privileged access.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-50181 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-50181.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2025-50181"
    },
    {
      "cve": "CVE-2025-53048",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "A vulnerability in Oracle PeopleSoft\u0027s Rich Text Editor component in versions 8.60, 8.61, and 8.62 allows low-privileged attackers to compromise the system through human interaction, risking unauthorized data access and modifications.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-53048 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-53048.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2025-53048"
    },
    {
      "cve": "CVE-2025-53050",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        },
        {
          "category": "description",
          "text": "A vulnerability in Oracle PeopleSoft\u0027s Performance Monitor component (versions 8.60, 8.61, 8.62) allows unauthenticated attackers to execute a denial of service attack via HTTP, with a CVSS score of 7.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-53050 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-53050.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2025-53050"
    },
    {
      "cve": "CVE-2025-53055",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "A vulnerability in Oracle PeopleSoft\u0027s Enterprise PeopleTools (versions 8.60, 8.61, and 8.62) allows unauthenticated attackers to compromise the system via HTTP, posing risks to data confidentiality and integrity with a CVSS score of 6.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-53055 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-53055.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2025-53055"
    },
    {
      "cve": "CVE-2025-53059",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Access Control",
          "title": "CWE-284"
        },
        {
          "category": "description",
          "text": "A vulnerability in Oracle PeopleSoft\u0027s OpenSearch Dashboards (versions 8.60, 8.61, and 8.62) allows high-privileged attackers with HTTP access to potentially gain unauthorized access to critical data, with a CVSS score of 4.9.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-53059 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-53059.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2025-53059"
    },
    {
      "cve": "CVE-2025-53061",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Access Control",
          "title": "CWE-284"
        },
        {
          "category": "description",
          "text": "A vulnerability in Oracle PeopleSoft\u0027s Enterprise PeopleTools (versions 8.60, 8.61, and 8.62) allows high-privileged attackers to compromise the system, impacting data confidentiality and integrity with a CVSS score of 5.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-53061 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-53061.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2025-53061"
    },
    {
      "cve": "CVE-2025-53063",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "A vulnerability in Oracle PeopleSoft\u0027s Enterprise PeopleTools (versions 8.60, 8.61, and 8.62) allows low-privileged attackers to compromise the system, posing a moderate risk with a CVSS score of 5.4.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-53063 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-53063.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2025-53063"
    },
    {
      "cve": "CVE-2025-53065",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "A vulnerability in Oracle PeopleSoft\u0027s Enterprise PeopleTools (versions 8.60, 8.61, and 8.62) allows unauthenticated attackers to compromise the system with human interaction, leading to unauthorized data access and modifications, with a CVSS score of 5.4.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-53065 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-53065.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2025-53065"
    },
    {
      "cve": "CVE-2025-61750",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        },
        {
          "category": "description",
          "text": "A vulnerability in Oracle PeopleSoft\u0027s Enterprise PeopleTools (versions 8.61 and 8.62) allows low-privileged attackers to gain unauthorized read access to certain data, with a CVSS 3.1 Base Score of 4.3 indicating confidentiality impacts.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-61750 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-61750.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2025-61750"
    },
    {
      "cve": "CVE-2025-61758",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Access Control",
          "title": "CWE-284"
        },
        {
          "category": "description",
          "text": "A vulnerability in Oracle PeopleSoft IT Asset Management 9.2 allows low-privileged attackers with network access to compromise the system, posing significant confidentiality risks with a CVSS score of 6.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-61758 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-61758.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2025-61758"
    },
    {
      "cve": "CVE-2025-61761",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Access Control",
          "title": "CWE-284"
        },
        {
          "category": "description",
          "text": "A vulnerability in Oracle PeopleSoft\u0027s FIN Maintenance Management product (version 9.2) allows low-privileged attackers to compromise data, resulting in unauthorized updates, deletions, and read access, with a CVSS score of 5.4.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-61761 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-61761.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2025-61761"
    },
    {
      "cve": "CVE-2025-61762",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Access Control",
          "title": "CWE-284"
        },
        {
          "category": "description",
          "text": "A vulnerability in Oracle PeopleSoft\u0027s FIN Payables product (version 9.2) allows low-privileged attackers to exploit the system via HTTP, potentially leading to unauthorized data access and partial denial of service, with a CVSS score of 6.3.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-61762 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-61762.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6"
          ]
        }
      ],
      "title": "CVE-2025-61762"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python311-urllib3-2.5.0-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python311-urllib3-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-15283",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15283-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-50181 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-50181/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-50182 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-50182/"
      }
    ],
    "title": "python311-urllib3-2.5.0-1.1 on GA media",
    "tracking": {
      "current_release_date": "2025-07-03T00:00:00Z",
      "generator": {
        "date": "2025-07-03T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:15283-1",
      "initial_release_date": "2025-07-03T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-07-03T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-urllib3-2.5.0-1.1.aarch64",
                "product": {
                  "name": "python311-urllib3-2.5.0-1.1.aarch64",
                  "product_id": "python311-urllib3-2.5.0-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python312-urllib3-2.5.0-1.1.aarch64",
                "product": {
                  "name": "python312-urllib3-2.5.0-1.1.aarch64",
                  "product_id": "python312-urllib3-2.5.0-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-urllib3-2.5.0-1.1.aarch64",
                "product": {
                  "name": "python313-urllib3-2.5.0-1.1.aarch64",
                  "product_id": "python313-urllib3-2.5.0-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-urllib3-2.5.0-1.1.ppc64le",
                "product": {
                  "name": "python311-urllib3-2.5.0-1.1.ppc64le",
                  "product_id": "python311-urllib3-2.5.0-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python312-urllib3-2.5.0-1.1.ppc64le",
                "product": {
                  "name": "python312-urllib3-2.5.0-1.1.ppc64le",
                  "product_id": "python312-urllib3-2.5.0-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python313-urllib3-2.5.0-1.1.ppc64le",
                "product": {
                  "name": "python313-urllib3-2.5.0-1.1.ppc64le",
                  "product_id": "python313-urllib3-2.5.0-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-urllib3-2.5.0-1.1.s390x",
                "product": {
                  "name": "python311-urllib3-2.5.0-1.1.s390x",
                  "product_id": "python311-urllib3-2.5.0-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python312-urllib3-2.5.0-1.1.s390x",
                "product": {
                  "name": "python312-urllib3-2.5.0-1.1.s390x",
                  "product_id": "python312-urllib3-2.5.0-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python313-urllib3-2.5.0-1.1.s390x",
                "product": {
                  "name": "python313-urllib3-2.5.0-1.1.s390x",
                  "product_id": "python313-urllib3-2.5.0-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-urllib3-2.5.0-1.1.x86_64",
                "product": {
                  "name": "python311-urllib3-2.5.0-1.1.x86_64",
                  "product_id": "python311-urllib3-2.5.0-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python312-urllib3-2.5.0-1.1.x86_64",
                "product": {
                  "name": "python312-urllib3-2.5.0-1.1.x86_64",
                  "product_id": "python312-urllib3-2.5.0-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-urllib3-2.5.0-1.1.x86_64",
                "product": {
                  "name": "python313-urllib3-2.5.0-1.1.x86_64",
                  "product_id": "python313-urllib3-2.5.0-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-urllib3-2.5.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.aarch64"
        },
        "product_reference": "python311-urllib3-2.5.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-urllib3-2.5.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.ppc64le"
        },
        "product_reference": "python311-urllib3-2.5.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-urllib3-2.5.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.s390x"
        },
        "product_reference": "python311-urllib3-2.5.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-urllib3-2.5.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.x86_64"
        },
        "product_reference": "python311-urllib3-2.5.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-urllib3-2.5.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.aarch64"
        },
        "product_reference": "python312-urllib3-2.5.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-urllib3-2.5.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.ppc64le"
        },
        "product_reference": "python312-urllib3-2.5.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-urllib3-2.5.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.s390x"
        },
        "product_reference": "python312-urllib3-2.5.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-urllib3-2.5.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.x86_64"
        },
        "product_reference": "python312-urllib3-2.5.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-urllib3-2.5.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.aarch64"
        },
        "product_reference": "python313-urllib3-2.5.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-urllib3-2.5.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.ppc64le"
        },
        "product_reference": "python313-urllib3-2.5.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-urllib3-2.5.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.s390x"
        },
        "product_reference": "python313-urllib3-2.5.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-urllib3-2.5.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.x86_64"
        },
        "product_reference": "python313-urllib3-2.5.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-50181",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-50181"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.aarch64",
          "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.s390x",
          "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.x86_64",
          "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.aarch64",
          "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.s390x",
          "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.x86_64",
          "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-50181",
          "url": "https://www.suse.com/security/cve/CVE-2025-50181"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1244925 for CVE-2025-50181",
          "url": "https://bugzilla.suse.com/1244925"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.s390x",
            "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.x86_64",
            "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.s390x",
            "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.x86_64",
            "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.s390x",
            "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.x86_64",
            "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.s390x",
            "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.x86_64",
            "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-50181"
    },
    {
      "cve": "CVE-2025-50182",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-50182"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.aarch64",
          "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.s390x",
          "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.x86_64",
          "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.aarch64",
          "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.s390x",
          "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.x86_64",
          "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-50182",
          "url": "https://www.suse.com/security/cve/CVE-2025-50182"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1244924 for CVE-2025-50182",
          "url": "https://bugzilla.suse.com/1244924"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.s390x",
            "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.x86_64",
            "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.s390x",
            "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.x86_64",
            "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.s390x",
            "openSUSE Tumbleweed:python311-urllib3-2.5.0-1.1.x86_64",
            "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.s390x",
            "openSUSE Tumbleweed:python312-urllib3-2.5.0-1.1.x86_64",
            "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3-2.5.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-50182"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python311-urllib3_1-1.26.20-3.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python311-urllib3_1-1.26.20-3.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-15284",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15284-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-50181 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-50181/"
      }
    ],
    "title": "python311-urllib3_1-1.26.20-3.1 on GA media",
    "tracking": {
      "current_release_date": "2025-07-03T00:00:00Z",
      "generator": {
        "date": "2025-07-03T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:15284-1",
      "initial_release_date": "2025-07-03T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-07-03T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-urllib3_1-1.26.20-3.1.aarch64",
                "product": {
                  "name": "python311-urllib3_1-1.26.20-3.1.aarch64",
                  "product_id": "python311-urllib3_1-1.26.20-3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python312-urllib3_1-1.26.20-3.1.aarch64",
                "product": {
                  "name": "python312-urllib3_1-1.26.20-3.1.aarch64",
                  "product_id": "python312-urllib3_1-1.26.20-3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-urllib3_1-1.26.20-3.1.aarch64",
                "product": {
                  "name": "python313-urllib3_1-1.26.20-3.1.aarch64",
                  "product_id": "python313-urllib3_1-1.26.20-3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-urllib3_1-1.26.20-3.1.ppc64le",
                "product": {
                  "name": "python311-urllib3_1-1.26.20-3.1.ppc64le",
                  "product_id": "python311-urllib3_1-1.26.20-3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python312-urllib3_1-1.26.20-3.1.ppc64le",
                "product": {
                  "name": "python312-urllib3_1-1.26.20-3.1.ppc64le",
                  "product_id": "python312-urllib3_1-1.26.20-3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python313-urllib3_1-1.26.20-3.1.ppc64le",
                "product": {
                  "name": "python313-urllib3_1-1.26.20-3.1.ppc64le",
                  "product_id": "python313-urllib3_1-1.26.20-3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-urllib3_1-1.26.20-3.1.s390x",
                "product": {
                  "name": "python311-urllib3_1-1.26.20-3.1.s390x",
                  "product_id": "python311-urllib3_1-1.26.20-3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python312-urllib3_1-1.26.20-3.1.s390x",
                "product": {
                  "name": "python312-urllib3_1-1.26.20-3.1.s390x",
                  "product_id": "python312-urllib3_1-1.26.20-3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python313-urllib3_1-1.26.20-3.1.s390x",
                "product": {
                  "name": "python313-urllib3_1-1.26.20-3.1.s390x",
                  "product_id": "python313-urllib3_1-1.26.20-3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-urllib3_1-1.26.20-3.1.x86_64",
                "product": {
                  "name": "python311-urllib3_1-1.26.20-3.1.x86_64",
                  "product_id": "python311-urllib3_1-1.26.20-3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python312-urllib3_1-1.26.20-3.1.x86_64",
                "product": {
                  "name": "python312-urllib3_1-1.26.20-3.1.x86_64",
                  "product_id": "python312-urllib3_1-1.26.20-3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-urllib3_1-1.26.20-3.1.x86_64",
                "product": {
                  "name": "python313-urllib3_1-1.26.20-3.1.x86_64",
                  "product_id": "python313-urllib3_1-1.26.20-3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-urllib3_1-1.26.20-3.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-urllib3_1-1.26.20-3.1.aarch64"
        },
        "product_reference": "python311-urllib3_1-1.26.20-3.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-urllib3_1-1.26.20-3.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-urllib3_1-1.26.20-3.1.ppc64le"
        },
        "product_reference": "python311-urllib3_1-1.26.20-3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-urllib3_1-1.26.20-3.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-urllib3_1-1.26.20-3.1.s390x"
        },
        "product_reference": "python311-urllib3_1-1.26.20-3.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-urllib3_1-1.26.20-3.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-urllib3_1-1.26.20-3.1.x86_64"
        },
        "product_reference": "python311-urllib3_1-1.26.20-3.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-urllib3_1-1.26.20-3.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-urllib3_1-1.26.20-3.1.aarch64"
        },
        "product_reference": "python312-urllib3_1-1.26.20-3.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-urllib3_1-1.26.20-3.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-urllib3_1-1.26.20-3.1.ppc64le"
        },
        "product_reference": "python312-urllib3_1-1.26.20-3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-urllib3_1-1.26.20-3.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-urllib3_1-1.26.20-3.1.s390x"
        },
        "product_reference": "python312-urllib3_1-1.26.20-3.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-urllib3_1-1.26.20-3.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-urllib3_1-1.26.20-3.1.x86_64"
        },
        "product_reference": "python312-urllib3_1-1.26.20-3.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-urllib3_1-1.26.20-3.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-urllib3_1-1.26.20-3.1.aarch64"
        },
        "product_reference": "python313-urllib3_1-1.26.20-3.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-urllib3_1-1.26.20-3.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-urllib3_1-1.26.20-3.1.ppc64le"
        },
        "product_reference": "python313-urllib3_1-1.26.20-3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-urllib3_1-1.26.20-3.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-urllib3_1-1.26.20-3.1.s390x"
        },
        "product_reference": "python313-urllib3_1-1.26.20-3.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-urllib3_1-1.26.20-3.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-urllib3_1-1.26.20-3.1.x86_64"
        },
        "product_reference": "python313-urllib3_1-1.26.20-3.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-50181",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-50181"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python311-urllib3_1-1.26.20-3.1.aarch64",
          "openSUSE Tumbleweed:python311-urllib3_1-1.26.20-3.1.ppc64le",
          "openSUSE Tumbleweed:python311-urllib3_1-1.26.20-3.1.s390x",
          "openSUSE Tumbleweed:python311-urllib3_1-1.26.20-3.1.x86_64",
          "openSUSE Tumbleweed:python312-urllib3_1-1.26.20-3.1.aarch64",
          "openSUSE Tumbleweed:python312-urllib3_1-1.26.20-3.1.ppc64le",
          "openSUSE Tumbleweed:python312-urllib3_1-1.26.20-3.1.s390x",
          "openSUSE Tumbleweed:python312-urllib3_1-1.26.20-3.1.x86_64",
          "openSUSE Tumbleweed:python313-urllib3_1-1.26.20-3.1.aarch64",
          "openSUSE Tumbleweed:python313-urllib3_1-1.26.20-3.1.ppc64le",
          "openSUSE Tumbleweed:python313-urllib3_1-1.26.20-3.1.s390x",
          "openSUSE Tumbleweed:python313-urllib3_1-1.26.20-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-50181",
          "url": "https://www.suse.com/security/cve/CVE-2025-50181"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1244925 for CVE-2025-50181",
          "url": "https://bugzilla.suse.com/1244925"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python311-urllib3_1-1.26.20-3.1.aarch64",
            "openSUSE Tumbleweed:python311-urllib3_1-1.26.20-3.1.ppc64le",
            "openSUSE Tumbleweed:python311-urllib3_1-1.26.20-3.1.s390x",
            "openSUSE Tumbleweed:python311-urllib3_1-1.26.20-3.1.x86_64",
            "openSUSE Tumbleweed:python312-urllib3_1-1.26.20-3.1.aarch64",
            "openSUSE Tumbleweed:python312-urllib3_1-1.26.20-3.1.ppc64le",
            "openSUSE Tumbleweed:python312-urllib3_1-1.26.20-3.1.s390x",
            "openSUSE Tumbleweed:python312-urllib3_1-1.26.20-3.1.x86_64",
            "openSUSE Tumbleweed:python313-urllib3_1-1.26.20-3.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3_1-1.26.20-3.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3_1-1.26.20-3.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3_1-1.26.20-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python311-urllib3_1-1.26.20-3.1.aarch64",
            "openSUSE Tumbleweed:python311-urllib3_1-1.26.20-3.1.ppc64le",
            "openSUSE Tumbleweed:python311-urllib3_1-1.26.20-3.1.s390x",
            "openSUSE Tumbleweed:python311-urllib3_1-1.26.20-3.1.x86_64",
            "openSUSE Tumbleweed:python312-urllib3_1-1.26.20-3.1.aarch64",
            "openSUSE Tumbleweed:python312-urllib3_1-1.26.20-3.1.ppc64le",
            "openSUSE Tumbleweed:python312-urllib3_1-1.26.20-3.1.s390x",
            "openSUSE Tumbleweed:python312-urllib3_1-1.26.20-3.1.x86_64",
            "openSUSE Tumbleweed:python313-urllib3_1-1.26.20-3.1.aarch64",
            "openSUSE Tumbleweed:python313-urllib3_1-1.26.20-3.1.ppc64le",
            "openSUSE Tumbleweed:python313-urllib3_1-1.26.20-3.1.s390x",
            "openSUSE Tumbleweed:python313-urllib3_1-1.26.20-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-07-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-50181"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "oci-cli-3.76.2-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the oci-cli-3.76.2-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10539",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10539-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-37891 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-37891/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47081 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47081/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-47273 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-47273/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-50181 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-50181/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-66418 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-66418/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-21441 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-21441/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-26007 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-26007/"
      }
    ],
    "title": "oci-cli-3.76.2-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-04-13T00:00:00Z",
      "generator": {
        "date": "2026-04-13T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10539-1",
      "initial_release_date": "2026-04-13T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-04-13T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "oci-cli-3.76.2-1.1.aarch64",
                "product": {
                  "name": "oci-cli-3.76.2-1.1.aarch64",
                  "product_id": "oci-cli-3.76.2-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "oci-cli-3.76.2-1.1.ppc64le",
                "product": {
                  "name": "oci-cli-3.76.2-1.1.ppc64le",
                  "product_id": "oci-cli-3.76.2-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "oci-cli-3.76.2-1.1.s390x",
                "product": {
                  "name": "oci-cli-3.76.2-1.1.s390x",
                  "product_id": "oci-cli-3.76.2-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "oci-cli-3.76.2-1.1.x86_64",
                "product": {
                  "name": "oci-cli-3.76.2-1.1.x86_64",
                  "product_id": "oci-cli-3.76.2-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oci-cli-3.76.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64"
        },
        "product_reference": "oci-cli-3.76.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oci-cli-3.76.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le"
        },
        "product_reference": "oci-cli-3.76.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oci-cli-3.76.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x"
        },
        "product_reference": "oci-cli-3.76.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oci-cli-3.76.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
        },
        "product_reference": "oci-cli-3.76.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-37891",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-37891"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": " urllib3 is a user-friendly HTTP client library for Python. When using urllib3\u0027s proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3\u0027s proxy support, it\u0027s possible to accidentally configure the `Proxy-Authorization` header even though it won\u0027t have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn\u0027t treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn\u0027t strip the header on cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are doing this on accident. Users should use urllib3\u0027s proxy support or disable automatic redirects to achieve safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default in order to further protect users who aren\u0027t using the correct approach. We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting the `Proxy-Authorization` header without using urllib3\u0027s built-in proxy support. 2. Not disabling HTTP redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to upgrade may use the `Proxy-Authorization` header with urllib3\u0027s `ProxyManager`, disable HTTP redirects using `redirects=False` when sending requests, or not user the `Proxy-Authorization` header as mitigations.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-37891",
          "url": "https://www.suse.com/security/cve/CVE-2024-37891"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1226469 for CVE-2024-37891",
          "url": "https://bugzilla.suse.com/1226469"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-13T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-37891"
    },
    {
      "cve": "CVE-2024-47081",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47081"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one\u0027s Requests Session.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47081",
          "url": "https://www.suse.com/security/cve/CVE-2024-47081"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1244039 for CVE-2024-47081",
          "url": "https://bugzilla.suse.com/1244039"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-13T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47081"
    },
    {
      "cve": "CVE-2025-47273",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-47273"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-47273",
          "url": "https://www.suse.com/security/cve/CVE-2025-47273"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243313 for CVE-2025-47273",
          "url": "https://bugzilla.suse.com/1243313"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-13T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-47273"
    },
    {
      "cve": "CVE-2025-50181",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-50181"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-50181",
          "url": "https://www.suse.com/security/cve/CVE-2025-50181"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1244925 for CVE-2025-50181",
          "url": "https://bugzilla.suse.com/1244925"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-13T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-50181"
    },
    {
      "cve": "CVE-2025-66418",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-66418"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-66418",
          "url": "https://www.suse.com/security/cve/CVE-2025-66418"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254866 for CVE-2025-66418",
          "url": "https://bugzilla.suse.com/1254866"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-13T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-66418"
    },
    {
      "cve": "CVE-2026-21441",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-21441"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "urllib3 is an HTTP client library for Python. urllib3\u0027s streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-21441",
          "url": "https://www.suse.com/security/cve/CVE-2026-21441"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256331 for CVE-2026-21441",
          "url": "https://bugzilla.suse.com/1256331"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-13T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-21441"
    },
    {
      "cve": "CVE-2026-26007",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-26007"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor \u003e 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it\u0027s easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This vulnerability is fixed in 46.0.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
          "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-26007",
          "url": "https://www.suse.com/security/cve/CVE-2026-26007"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258074 for CVE-2026-26007",
          "url": "https://bugzilla.suse.com/1258074"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.aarch64",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.ppc64le",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.s390x",
            "openSUSE Tumbleweed:oci-cli-3.76.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-13T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-26007"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new version of Red Hat build of Ceph Storage has been released",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Red Hat Storage Ceph container images are based on the latest ubi9 base image and Ceph 7.1.\nThis release updates to the latest version.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:33154",
        "url": "https://access.redhat.com/errata/RHSA-2026:33154"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-12905",
        "url": "https://access.redhat.com/security/cve/CVE-2024-12905"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-55565",
        "url": "https://access.redhat.com/security/cve/CVE-2024-55565"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-6345",
        "url": "https://access.redhat.com/security/cve/CVE-2024-6345"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-13465",
        "url": "https://access.redhat.com/security/cve/CVE-2025-13465"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-45768",
        "url": "https://access.redhat.com/security/cve/CVE-2025-45768"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-47913",
        "url": "https://access.redhat.com/security/cve/CVE-2025-47913"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-50181",
        "url": "https://access.redhat.com/security/cve/CVE-2025-50181"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-52555",
        "url": "https://access.redhat.com/security/cve/CVE-2025-52555"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-5889",
        "url": "https://access.redhat.com/security/cve/CVE-2025-5889"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-59343",
        "url": "https://access.redhat.com/security/cve/CVE-2025-59343"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-21441",
        "url": "https://access.redhat.com/security/cve/CVE-2026-21441"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_ceph_storage/",
        "url": "https://docs.redhat.com/en/documentation/red_hat_ceph_storage/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33154.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Ceph Storage",
    "tracking": {
      "current_release_date": "2026-06-30T04:33:30+00:00",
      "generator": {
        "date": "2026-06-30T04:33:30+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.0"
        }
      },
      "id": "RHSA-2026:33154",
      "initial_release_date": "2026-06-29T15:52:25+00:00",
      "revision_history": [
        {
          "date": "2026-06-29T15:52:25+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-29T15:52:35+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-30T04:33:30+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ceph Storage 7.1",
                "product": {
                  "name": "Red Hat Ceph Storage 7.1",
                  "product_id": "Red Hat Ceph Storage 7.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ceph_storage:7.1::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ceph Storage"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
                "product": {
                  "name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
                  "product_id": "registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/grafana-rhel9@sha256%3A8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c?arch=amd64\u0026repository_url=registry.redhat.io/rhceph/grafana-rhel9\u0026tag=1781855851"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
                "product": {
                  "name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
                  "product_id": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhceph-haproxy-rhel9@sha256%3A14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734?arch=amd64\u0026repository_url=registry.redhat.io/rhceph/rhceph-haproxy-rhel9\u0026tag=1781856344"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
                "product": {
                  "name": "registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
                  "product_id": "registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keepalived-rhel9@sha256%3Ada760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3?arch=amd64\u0026repository_url=registry.redhat.io/rhceph/keepalived-rhel9\u0026tag=1781855108"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
                "product": {
                  "name": "registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
                  "product_id": "registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhceph-promtail-rhel9@sha256%3A3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7?arch=amd64\u0026repository_url=registry.redhat.io/rhceph/rhceph-promtail-rhel9\u0026tag=1781856148"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
                "product": {
                  "name": "registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
                  "product_id": "registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhceph-7-rhel9@sha256%3Abe5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812?arch=amd64\u0026repository_url=registry.redhat.io/rhceph/rhceph-7-rhel9\u0026tag=1781863705"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
                "product": {
                  "name": "registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
                  "product_id": "registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/snmp-notifier-rhel9@sha256%3A014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6?arch=amd64\u0026repository_url=registry.redhat.io/rhceph/snmp-notifier-rhel9\u0026tag=1781854814"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
                "product": {
                  "name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
                  "product_id": "registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/grafana-rhel9@sha256%3Afebdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898?arch=s390x\u0026repository_url=registry.redhat.io/rhceph/grafana-rhel9\u0026tag=1781855851"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
                "product": {
                  "name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
                  "product_id": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhceph-haproxy-rhel9@sha256%3A3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb?arch=s390x\u0026repository_url=registry.redhat.io/rhceph/rhceph-haproxy-rhel9\u0026tag=1781856344"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
                "product": {
                  "name": "registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
                  "product_id": "registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keepalived-rhel9@sha256%3A3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30?arch=s390x\u0026repository_url=registry.redhat.io/rhceph/keepalived-rhel9\u0026tag=1781855108"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
                "product": {
                  "name": "registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
                  "product_id": "registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhceph-promtail-rhel9@sha256%3A3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e?arch=s390x\u0026repository_url=registry.redhat.io/rhceph/rhceph-promtail-rhel9\u0026tag=1781856148"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
                "product": {
                  "name": "registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
                  "product_id": "registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhceph-7-rhel9@sha256%3Afe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a?arch=s390x\u0026repository_url=registry.redhat.io/rhceph/rhceph-7-rhel9\u0026tag=1781863705"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
                "product": {
                  "name": "registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
                  "product_id": "registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/snmp-notifier-rhel9@sha256%3A09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853?arch=s390x\u0026repository_url=registry.redhat.io/rhceph/snmp-notifier-rhel9\u0026tag=1781854814"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
                  "product_id": "registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/grafana-rhel9@sha256%3Aeb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717?arch=ppc64le\u0026repository_url=registry.redhat.io/rhceph/grafana-rhel9\u0026tag=1781855851"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
                  "product_id": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhceph-haproxy-rhel9@sha256%3A4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7?arch=ppc64le\u0026repository_url=registry.redhat.io/rhceph/rhceph-haproxy-rhel9\u0026tag=1781856344"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
                  "product_id": "registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keepalived-rhel9@sha256%3A44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6?arch=ppc64le\u0026repository_url=registry.redhat.io/rhceph/keepalived-rhel9\u0026tag=1781855108"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
                  "product_id": "registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhceph-promtail-rhel9@sha256%3Aee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117?arch=ppc64le\u0026repository_url=registry.redhat.io/rhceph/rhceph-promtail-rhel9\u0026tag=1781856148"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
                  "product_id": "registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhceph-7-rhel9@sha256%3A57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98?arch=ppc64le\u0026repository_url=registry.redhat.io/rhceph/rhceph-7-rhel9\u0026tag=1781863705"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le",
                  "product_id": "registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/snmp-notifier-rhel9@sha256%3Aeb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734?arch=ppc64le\u0026repository_url=registry.redhat.io/rhceph/snmp-notifier-rhel9\u0026tag=1781854814"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64 as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64"
        },
        "product_reference": "registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x"
        },
        "product_reference": "registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x"
        },
        "product_reference": "registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64 as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64"
        },
        "product_reference": "registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64 as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64"
        },
        "product_reference": "registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
        },
        "product_reference": "registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64 as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64"
        },
        "product_reference": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x"
        },
        "product_reference": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x"
        },
        "product_reference": "registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64 as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64"
        },
        "product_reference": "registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64 as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64"
        },
        "product_reference": "registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x"
        },
        "product_reference": "registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le as a component of Red Hat Ceph Storage 7.1",
          "product_id": "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le",
        "relates_to_product_reference": "Red Hat Ceph Storage 7.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-6345",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2024-07-15T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2297771"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the package_index module of pypa/setuptools. Affected versions of this package allow remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat OpenStack does not include setuptools. The ImcSdk component uses it only during compile time in our build systems, and we do not support recompiling SRPMs. As a result, Red Hat OpenStack is not affected by this flaw.\n\nPython 2.7.18 was marked End of Life on 04/20/2020. No patches for Python 2 would be made available.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
        ],
        "known_not_affected": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-6345"
        },
        {
          "category": "external",
          "summary": "RHBZ#2297771",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2297771"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-6345",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-6345"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-6345",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6345"
        },
        {
          "category": "external",
          "summary": "https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0",
          "url": "https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0"
        },
        {
          "category": "external",
          "summary": "https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5",
          "url": "https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5"
        }
      ],
      "release_date": "2024-07-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-29T15:52:25+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:33154"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools"
    },
    {
      "cve": "CVE-2024-12905",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2025-03-27T17:02:14.911888+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2355460"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the tar-fs package for Node.js. In affected versions, unauthorized file writes or overwrites outside the intended extraction directory can occur when extracting a maliciously crafted tar file. The issue is associated with index.js in the tar-fs package.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar-fs: link following and path traversal via maliciously crafted tar file",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an important severity because it allows attackers to extract a malicious tar file that can write or overwrite files outside the intended directory. This occurs due to improper handling of link resolution and pathname limitations. The risk is high for systems that automatically extract tar files, as it can lead to data corruption or unauthorized file modifications without user interaction.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
        ],
        "known_not_affected": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-12905"
        },
        {
          "category": "external",
          "summary": "RHBZ#2355460",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2355460"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-12905",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-12905"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12905",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12905"
        },
        {
          "category": "external",
          "summary": "https://github.com/mafintosh/tar-fs/commit/a1dd7e7c7f4b4a8bd2ab60f513baca573b44e2ed",
          "url": "https://github.com/mafintosh/tar-fs/commit/a1dd7e7c7f4b4a8bd2ab60f513baca573b44e2ed"
        }
      ],
      "release_date": "2025-03-27T16:25:34.410000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-29T15:52:25+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:33154"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tar-fs: link following and path traversal via maliciously crafted tar file"
    },
    {
      "cve": "CVE-2024-55565",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2024-12-09T02:00:45.255738+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331063"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nanoid. Affected versions of nanoid mishandles non-integer values. When nanoid is called with a fractional value, there were a number of undesirable effects:\n\n- In browser and non-secure, the code infinite loops on while (size--)\n- In node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled: when i is initialized to poolOffset, pool[i] \u0026 63 -\u003e undefined \u0026 63 -\u003e 0\n- If the first call in node is a fractional argument, the initial buffer allocation fails with an error\n\nThe highest impact of this issue system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nanoid: nanoid mishandles non-integer values",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
        ],
        "known_not_affected": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-55565"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331063",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331063"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-55565",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-55565"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-55565",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55565"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/compare/3.3.7...3.3.8",
          "url": "https://github.com/ai/nanoid/compare/3.3.7...3.3.8"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/pull/510",
          "url": "https://github.com/ai/nanoid/pull/510"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/releases/tag/5.0.9",
          "url": "https://github.com/ai/nanoid/releases/tag/5.0.9"
        }
      ],
      "release_date": "2024-12-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-29T15:52:25+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:33154"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nanoid: nanoid mishandles non-integer values"
    },
    {
      "cve": "CVE-2025-5889",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2025-06-09T19:00:43.176857+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2371270"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial-of-service (DoS) vulnerability has been identified in the brace-expansion JavaScript package. This issue occurs due to inefficient regular expression complexity, which can be exploited by an attacker providing specially crafted input. Such input could lead to excessive processing time and resource consumption, rendering applications that utilize this package unresponsive and causing a denial-of-service condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: juliangruber brace-expansion index.js expand redos",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
        ],
        "known_not_affected": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-5889"
        },
        {
          "category": "external",
          "summary": "RHBZ#2371270",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2371270"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-5889",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-5889"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-5889",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5889"
        },
        {
          "category": "external",
          "summary": "https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466",
          "url": "https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5",
          "url": "https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?ctiid.311660",
          "url": "https://vuldb.com/?ctiid.311660"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?id.311660",
          "url": "https://vuldb.com/?id.311660"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?submit.585717",
          "url": "https://vuldb.com/?submit.585717"
        }
      ],
      "release_date": "2025-06-09T18:16:01.889000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-29T15:52:25+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:33154"
        },
        {
          "category": "workaround",
          "details": "Currently, no mitigation is available for this vulnerability.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "brace-expansion: juliangruber brace-expansion index.js expand redos"
    },
    {
      "cve": "CVE-2025-13465",
      "cwe": {
        "id": "CWE-1321",
        "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
      },
      "discovery_date": "2026-01-21T20:01:28.774829+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2431740"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "lodash: prototype pollution in _.unset and _.omit functions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is only exploitable by applications using the _.unset and _.omit functions on an object and allowing user input to determine the path of the property to be removed. This issue only allows the deletion of properties but does not allow overwriting their behavior, limiting the impact to a denial of service. Due to this reason, this vulnerability has been rated with an important severity.\n\nIn Grafana, JavaScript code runs only in the browser, while the server side is all Golang. Therefore, the worst-case scenario is a loss of functionality in the client application inside the browser. To reflect this, the CVSS availability metric and the severity of the Grafana and the Grafana-PCP component have been updated to low and moderate, respectively.\n\nThe lodash dependency is bundled and used by the pcs-web-ui component of the PCS package. In Red Hat Enterprise Linux 8.10, the pcs-web-ui component is no longer included in the PCS package. As a result, RHEL 8.10 does not ship the vulnerable lodash component within PCS and is therefore not-affected by this CVE.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
        ],
        "known_not_affected": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-13465"
        },
        {
          "category": "external",
          "summary": "RHBZ#2431740",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431740"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-13465",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-13465"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465"
        },
        {
          "category": "external",
          "summary": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg",
          "url": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg"
        }
      ],
      "release_date": "2026-01-21T19:05:28.846000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-29T15:52:25+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:33154"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "lodash: prototype pollution in _.unset and _.omit functions"
    },
    {
      "cve": "CVE-2025-45768",
      "discovery_date": "2025-07-31T21:01:30.698283+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pyjwt. The library uses weak encryption, allowing an attacker to potentially decrypt sensitive data. A network-based attacker can exploit this vulnerability without authentication, possibly resulting in a denial of service or data exposure. This weakness stems from the use of inadequate cryptographic algorithms.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "This CVE has been disputed by the PyJWT. The developers of PyJWT confirm that this issue is not a flaw in the library\u0027s function but rather a potential risk if an application developer chooses to use weak, short cryptographic keys.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
        ],
        "known_not_affected": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-45768"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-45768",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-45768"
        }
      ],
      "release_date": "2025-07-31T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-29T15:52:25+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:33154"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0.0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "pyjwt: pyjwt Weak Encryption Vulnerability"
    },
    {
      "cve": "CVE-2025-47913",
      "discovery_date": "2025-11-13T22:01:26.092452+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2414943"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in golang.org/x/crypto/ssh/agent causes the SSH agent client to panic when a peer responds with the generic SSH_AGENT_SUCCESS (0x06) message to requests expecting typed replies (e.g., List, Sign). The unmarshal layer produces an unexpected message type, which the client code does not handle, leading to panic(\"unreachable\") or a nil-pointer dereference. A malicious agent or forwarded connection can exploit this to terminate the client process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability was marked as Important because it allows any malicious or misbehaving SSH agent to force a crash in the client process using a single valid protocol byte. The panic occurs before the client has a chance to validate message structure or recover, which means an attacker controlling\u2014or intercepting\u2014SSH agent traffic can reliably terminate processes that rely on agent interactions. In environments where SSH agents operate over forwarded sockets, shared workspaces, or CI/CD runners, this turns into a reliable, unauthenticated remote denial of service against critical automation or developer tooling. The flaw also stems from unsafe assumptions in the unmarshalling logic, where unexpected but protocol-legal message types drop into \u201cunreachable\u201d code paths instead of being handled gracefully\u2014making it a design-level reliability break rather than a simple error-handling bug. For this reason, it is rated as an important availability-impacting vulnerability rather than a moderate issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x"
        ],
        "known_not_affected": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-47913"
        },
        {
          "category": "external",
          "summary": "RHBZ#2414943",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414943"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-47913",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-47913"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-47913",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47913"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-hcg3-q754-cr77",
          "url": "https://github.com/advisories/GHSA-hcg3-q754-cr77"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/700295",
          "url": "https://go.dev/cl/700295"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/75178",
          "url": "https://go.dev/issue/75178"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4116",
          "url": "https://pkg.go.dev/vuln/GO-2025-4116"
        }
      ],
      "release_date": "2025-11-13T21:29:39.907000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-29T15:52:25+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:33154"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS"
    },
    {
      "cve": "CVE-2025-50181",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "discovery_date": "2025-06-19T02:00:42.866992+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2373799"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3. The `PoolManager` class allows redirects to be disabled by configuring retries in a specific manner, effectively bypassing intended HTTP redirection behavior. A network attacker can leverage this configuration to manipulate request flows and disrupt service. This bypass occurs through improper handling of retry parameters during PoolManager instantiation. This issue can reult in a denial of service or unintended data exposure due to altered request destinations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the urllib3 library where it could be tricked into disclosing the Proxy-Authorization header to a destination server when a CONNECT tunnel is used. An attacker can set up a malicious redirect to a crafted URL, which, when followed by the client application, will cause the Proxy-Authorization header to be sent to the attacker-controlled server. This leaks sensitive credentials for the proxy. The impact is primarily on confidentiality. While urllib3 is a ubiquitous component, the vulnerability requires a specific scenario where a user is connecting to a proxy that requires authentication and is redirected to a malicious endpoint. This lowers the exploitability compared to a direct, unauthenticated remote attack, thus, warranting a Moderate severity rating.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x"
        ],
        "known_not_affected": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-50181"
        },
        {
          "category": "external",
          "summary": "RHBZ#2373799",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373799"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-50181",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-50181"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-50181",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50181"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857",
          "url": "https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"
        }
      ],
      "release_date": "2025-06-19T01:08:00.340000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-29T15:52:25+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:33154"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation"
    },
    {
      "cve": "CVE-2025-52555",
      "cwe": {
        "id": "CWE-272",
        "name": "Least Privilege Violation"
      },
      "discovery_date": "2025-06-23T21:07:48.565000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2374412"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Ceph was discovered whereby an unprivileged user could change the permissions of a directory owned by the root user, gaining access to the targeted directory. The non-privileged user can escalate privileges to root in a CephFS mounted with ceph-fuse by applying chmod 777 (read, write, and execute for all users) to any directory owned by root. This allows the user to read, write, and execute to that directory even if they were not the original owner. The vulnerability could potentially allow a user to gain unauthorized access or modify critical system data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ceph: privilege escalation by unprivileged users in a ceph-fuse mounted CephFS",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
        ],
        "known_not_affected": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-52555"
        },
        {
          "category": "external",
          "summary": "RHBZ#2374412",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2374412"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-52555",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-52555"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52555",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52555"
        },
        {
          "category": "external",
          "summary": "https://github.com/ceph/ceph/pull/60314",
          "url": "https://github.com/ceph/ceph/pull/60314"
        },
        {
          "category": "external",
          "summary": "https://github.com/ceph/ceph/security/advisories/GHSA-89hm-qq33-2fjm",
          "url": "https://github.com/ceph/ceph/security/advisories/GHSA-89hm-qq33-2fjm"
        }
      ],
      "release_date": "2025-06-26T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-29T15:52:25+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:33154"
        },
        {
          "category": "workaround",
          "details": "Red Hat Product Security does not have any recommended mitigations at this time. Please update as patched versions become available.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ceph: privilege escalation by unprivileged users in a ceph-fuse mounted CephFS"
    },
    {
      "cve": "CVE-2025-59343",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2025-09-24T18:01:19.612438+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2397901"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A symlink validation bypass flaw has been discovered in the npm tar-fs library. Affected versions are vulnerable to a symlink validation bypass if the destination directory is predictable with a specific tarball.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar-fs: tar-fs symlink validation bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
        ],
        "known_not_affected": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-59343"
        },
        {
          "category": "external",
          "summary": "RHBZ#2397901",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397901"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-59343",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-59343"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-59343",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59343"
        },
        {
          "category": "external",
          "summary": "https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09",
          "url": "https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09"
        },
        {
          "category": "external",
          "summary": "https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v",
          "url": "https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v"
        }
      ],
      "release_date": "2025-09-24T17:43:34.728000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-29T15:52:25+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:33154"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tar-fs: tar-fs symlink validation bypass"
    },
    {
      "cve": "CVE-2026-21441",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-01-07T23:01:59.422078+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2427726"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "urllib3 is an HTTP client library for Python. urllib3\u0027s streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
        ],
        "known_not_affected": [
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
          "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21441"
        },
        {
          "category": "external",
          "summary": "RHBZ#2427726",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427726"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21441",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21441"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21441",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21441"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b",
          "url": "https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99"
        }
      ],
      "release_date": "2026-01-07T22:09:01.936000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-29T15:52:25+00:00",
          "details": "The container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command.",
          "product_ids": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:33154"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:eb16743753a9a8d1c781d211a52e7e7ef1eb85c5d816b1328b48196a330af717_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/grafana-rhel9@sha256:febdc339e022b45a25d0956536adda36c761e71770a0d60475ea7ae4a331d898_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:3a4815d3406f797d153af4ec0f8d599981f44bb7fd98429b3ea8f935b4b96d30_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:44d1c4858b983250a223f56d1dbb4f255bb9c2ac50d0f5dbabdc62f9519789b6_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/keepalived-rhel9@sha256:da760b2fd9c2636f5b82e1d3b332f2efe0bbbbbe0624bf4c912bda10be057fe3_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:57eaf98ed402584fca1e6b804ad97fbf2287219ad617f69c96b0cd48279e7a98_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:be5cbfcebfac4d05e8b1e6c39e00a7571987d1a7efd995b4ea6333c8c0a7e812_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:fe482274c22406b77c3fd4bd4822b10f0d1e94bdc7a69fa1843a2f3d85860c8a_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:14f8f48bbcbd2f61be00cf5cbe636fa13f65404732e115fdb910bbce7578c734_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3b07124326d4fb24eabbc3127068a00a8e54873943a9e4896f276e9be1f5c8bb_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c30728f5f5c19a7b570bd677e3733c68dff8d661da292a304318fdc87d235c7_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3068c146d01dd9e5065d4a18158e57be1dbe88d53ecc71b44ab832f359b9537e_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3529361e69b98fa7875f542d8e2fc90cbbc694b12b442ee354b8c008f623d2f7_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ee7d1dbad6fbd2a80b00db3cd949bd6b45f17b90aec8400d79c6ee2d6dea1117_ppc64le",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:014266a322f1df6bcec437f06ff66e8dee91a2f84e6a8333b6035b0031a165b6_amd64",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:09c6b326c8582909aac8a4f782ff0ff352cc3347a26f0e282be7537dfa746853_s390x",
            "Red Hat Ceph Storage 7.1:registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:eb7dcdf167e1319f218aae5bf042ad79336821e854dfaf6283b38f0b1b186734_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)"
    }
  ]
}